CVE-2026-55667

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.

• CWE-22
• CWE-59

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr

Published

Jun 25, 2026

Last Modified

Jun 26, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5566A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7…8.8
• CVE-2026-55660Tina is a headless content management system. In versions pr…7.6
• CVE-2026-55661Tina is a headless content management system. In versions pr…4.8
• CVE-2026-55664Grist is spreadsheet software using Python as its formula la…4.3
• CVE-2026-55665Grist is spreadsheet software using Python as its formula la…8.5
• CVE-2026-55666Rocket.Chat is an open-source, secure, fully customizable co…9.3
• CVE-2026-55668File Browser provides a web file managing interface. Prior t…6.3
• CVE-2026-55669ZITADEL is an open source identity management platform. Prio…4.2
• CVE-2026-5567A flaw has been found in Tenda M3 1.0.0.10. This vulnerabili…8.8
• CVE-2026-55670ZITADEL is an open source identity management platform. Prio…2.3
• CVE-2026-55671ZITADEL is an open source identity management platform. From…2.3
• CVE-2026-55672ZITADEL is an open source identity management platform. Prio…7.4