CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup

Executive brief

File Browser is a web-based file management utility. A security flaw allows a restricted user with only 'create' permissions to delete files they should not be able to access, including other users' data or the application's own configuration database. This could lead to significant data loss or a complete shutdown of the service.

Technical details

This vulnerability is an incomplete fix for CVE-2026-54094. While most filesystem operations in the ScopedFs wrapper are protected by a 'guard()' function that evaluates symlinks, the Remove and RemoveAll methods skip this check. An attacker with 'Perm.Create' can trigger a failed upload to a path containing a pre-existing directory symlink. The resourcePostHandler fails to terminate on containment errors and proceeds to a cleanup phase that calls the unguarded RemoveAll on the user-provided path. This allows the deletion of any file or directory reachable by the File Browser process, including the application database, provided a symlink already exists within the user's scope.

Affected products

• filebrowser filebrowser <= 2.63.15

Timeline

• 2026-06-25: advisory: NVD published date
• 2026-07-20: disclosed: GitHub Advisory published

References

• https://api.github.com/users/babakizo420
• https://github.com/babakizo420
• https://api.github.com/users/babakizo420/gists%7B/gist_id%7D
• https://api.github.com/users/babakizo420/repos
• https://avatars.githubusercontent.com/u/170581725?v=4
• https://api.github.com/users/babakizo420/events%7B/privacy%7D