Description
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Published: 2026-09-14
Score: 7.6 High
EPSS: n/a
KEV: No
Impact: Unauthorized file read/write via path traversal
Action: Immediate Patch
AI Analysis

Impact

File Browser through 2.63.23 applies symbolic links without reapplying the rules to the target. As a result, authenticated users can access files that should be denied by rule sets through symlink aliases. The flaw enables unauthorized reading and overwriting of protected files, compromising confidentiality and integrity. CWE-59 indicates an improper handling of path traversal.

Affected Systems

The vulnerability affects the open‑source File Browser application from the File Browser organization. All releases up to and including version 2.63.23 are susceptible. Versions earlier than 2.63.24 are affected; newer releases contain the fix.

Risk and Exploitability

The CVSS base score is 7.6, indicating high severity. EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires valid user credentials and a properly configured File Browser instance; therefore the attack vector is for systems exposing rule‑denied files through symbolic links, and prompt remediation is recommended.

Generated by OpenCVE AI on September 14, 2026 at 20:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to File Browser 2.63.24 or later; the update re‑applies path rules when resolving symbolic links.
  • If an upgrade is not immediately possible, limit the allowed symbolic links or configure the application to deny absolute paths outside the permitted directory tree.
  • Review existing deny rules and audit symbolic links in shared directories to ensure they do not point to protected files; apply the latest security patches as they become available.

Generated by OpenCVE AI on September 14, 2026 at 20:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 14 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 14 Sep 2026 13:00:00 +0000

Type Values Removed Values Added
Description File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Title File Browser through 2.63.23 Path Traversal via Symlink Alias
First Time appeared Filebrowser
Filebrowser filebrowser
Weaknesses CWE-59
CPEs cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*
Vendors & Products Filebrowser
Filebrowser filebrowser
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Filebrowser Filebrowser
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-14T14:17:49.647Z

Reserved: 2026-09-14T11:33:51.886Z

Link: CVE-2026-90930

cve-icon Vulnrichment

Updated: 2026-09-14T14:17:45.245Z

cve-icon NVD

Status : Received

Published: 2026-09-14T13:19:31.190

Modified: 2026-09-14T15:17:13.793

Link: CVE-2026-90930

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-14T21:00:09Z

Weaknesses
  • CWE-59

    Improper Link Resolution Before File Access ('Link Following')