Is CVE-2026-55667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55667 being exploited in the wild.

How severe is CVE-2026-55667?

High severity, with a CVSS score of 8.2, published 25 June 2026.

Which products and versions are affected?

File Browser <= 2.63.15; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.15, SEMVER:introduced=0,fixed=2.63.16.

Is there a fix for CVE-2026-55667?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55667 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55667?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup

Q: Which products and versions are affected?

File Browser <= 2.63.15; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.15, SEMVER:introduced=0,fixed=2.63.16.

Q: Is there a fix for CVE-2026-55667?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55667 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55667?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55667 · Severity: high · CVSS 8.2 · Published 2026-06-25

File Browser is a web-based file management utility. A security flaw allows a restricted user with only 'create' permissions to delete files they should not be able to access, including other users' data or the application's own configuration database. This could lead to significant data loss or a complete shutdown of the service.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-55667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55667 being exploited in the wild.
How severe is CVE-2026-55667?: High severity, with a CVSS score of 8.2, published 25 June 2026.
Which products and versions are affected?: File Browser <= 2.63.15; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.15, SEMVER:introduced=0,fixed=2.63.16.
Is there a fix for CVE-2026-55667?: Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55667 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55667?: Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later
```
go get github.com/filebrowser/filebrowser/v2@v2.63.16
```

Technical details

This vulnerability is an incomplete fix for CVE-2026-54094. While most filesystem operations in the ScopedFs wrapper are protected by a 'guard()' function that evaluates symlinks, the Remove and RemoveAll methods skip this check. An attacker with 'Perm.Create' can trigger a failed upload to a path containing a pre-existing directory symlink. The resourcePostHandler fails to terminate on containment errors and proceeds to a cleanup phase that calls the unguarded RemoveAll on the user-provided path. This allows the deletion of any file or directory reachable by the File Browser process, including the application database, provided a symlink already exists within the user's scope.

Affected products

filebrowser filebrowser <= 2.63.15

Identifiers

CVE-2026-55667
GHSA-fmm7-x4gx-8jhr
GO-2026-6021

Timeline

2026-06-25: advisory: NVD published date
2026-07-20: disclosed: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.