CVE-2026-73613 PUBLISHED

filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

Assigner: VulnCheck
Reserved: 13.08.2026 Published: 13.08.2026 Updated: 13.08.2026

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H
CVSS Score: 7.2

Product Status

Vendor filebrowser
Product filebrowser
Versions Default: unaffected
  • affected from 0 to 2.63.19 (excl.)
  • Version 2.63.19 is unaffected

Credits

  • manus-use reporter
  • hacdias finder

References

Problem Types

  • Improper Link Resolution Before File Access ('Link Following') CWE