File Browser’s ScopedFs component incorrectly validates the nearest existing ancestor of a dangling symbolic link as being in scope and then follows the link when creating a file. An authenticated user who has Create and Modify rights can exploit this flaw to write files to any location outside the directory that the user is permitted to access. This allows an attacker to place malicious files, overwrite critical configuration or system files, and potentially compromise the confidentiality, integrity, and availability of the host. The vulnerability is a classic path traversal (CWE‑22/CWE‑59) that is invoked by a file‑creation request through the web interface, so remote attackers must have valid credentials or be able to compromise a session to use it.

Any installation of the filebrowser:filebrowser product running a version earlier than 2.63.16 is affected. Users running v2.63.x must upgrade to 2.63.16 or newer to receive the ScopedFs fix.

The CVSS score of 6.3 indicates moderate severity. With an EPSS score of less than 1% and absence from the CISA KEV catalog, the likelihood of active exploitation is currently low. Nevertheless, the flaw requires only authenticated Create/Modify privileges, meaning any legitimate user granted those rights could abuse it if privileged, and a remote attacker who can obtain or hijack such credentials can trigger the issue through the standard web interface.