CVE-2026-90930

File Browser through 2.63.23 Path Traversal via Symlink Alias

Published Sep 14, 2026 CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Description

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

Analysis

Technical impact

File Browser through 2.63.23 applies symbolic links without reapplying the rules to the target. As a result, authenticated users can access files that should be denied by rule sets through symlink aliases. The flaw enables unauthorized reading and overwriting of protected files, compromising confidentiality and integrity. CWE-59 indicates an improper handling of path traversal.

Affected Systems

The vulnerability affects the open‑source File Browser application from the File Browser organization. All releases up to and including version 2.63.23 are susceptible. Versions earlier than 2.63.24 are affected; newer releases contain the fix.

Risk and Exploitability

The CVSS base score is 7.6, indicating high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid user credentials and a properly configured File Browser instance; therefore the attack vector is for systems exposing rule‑denied files through symbolic links, and prompt remediation is recommended.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

filebrowser

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.63.23

No data.

Vendor Product Versions

Filebrowser

Version	Status	Scheme	Platform
`[0,2.63.23]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to File Browser 2.63.24 or later; the update re‑applies path rules when resolving symbolic links.
If an upgrade is not immediately possible, limit the allowed symbolic links or configure the application to deny absolute paths outside the permitted directory tree.
Review existing deny rules and audit symbolic links in shared directories to ensure they do not point to protected files; apply the latest security patches as they become available.

Generated by OpenCVE AI on September 15, 2026 at 14:13 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.500% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9
https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias

History

Sep 14, 2026 9:00 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 1:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Title		File Browser through 2.63.23 Path Traversal via Symlink Alias
First Time appeared		Filebrowser Filebrowser filebrowser
Weaknesses		CWE-59
CPEs		cpe:2.3:a:filebrowser:filebrowser::::::::
Vendors & Products		Filebrowser Filebrowser filebrowser
References		https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9 https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`