Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-73613

filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

filebrowser filebrowser

Default version status: unaffected

  • 0 to < 2.63.19affected
  • 2.63.19unaffected
pkg:golang/github.com/filebrowser/filebrowser/v2

References