# CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup

Source: https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-55667 · Severity: high · CVSS 8.2 · Published 2026-06-25

File Browser is a web-based file management utility. A security flaw allows a restricted user with only 'create' permissions to delete files they should not be able to access, including other users' data or the application's own configuration database. This could lead to significant data loss or a complete shutdown of the service.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser), [github.com/filebrowser/filebrowser (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser), [github.com/filebrowser/filebrowser/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55667 being exploited in the wild.

**How severe is CVE-2026-55667?** High severity, with a CVSS score of 8.2, published 25 June 2026.

**Which products and versions are affected?** File Browser <= 2.63.15; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.15, SEMVER:introduced=0,fixed=2.63.16.

**Is there a fix for CVE-2026-55667?** Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55667 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-55667?** Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later

  ```sh
  go get github.com/filebrowser/filebrowser/v2@v2.63.16
  ```


## Technical details

This vulnerability is an incomplete fix for CVE-2026-54094. While most filesystem operations in the ScopedFs wrapper are protected by a 'guard()' function that evaluates symlinks, the Remove and RemoveAll methods skip this check. An attacker with 'Perm.Create' can trigger a failed upload to a path containing a pre-existing directory symlink. The resourcePostHandler fails to terminate on containment errors and proceeds to a cleanup phase that calls the unguarded RemoveAll on the user-provided path. This allows the deletion of any file or directory reachable by the File Browser process, including the application database, provided a symlink already exists within the user's scope.

## Affected products

- filebrowser filebrowser <= 2.63.15

## Identifiers

- CVE-2026-55667
- GHSA-fmm7-x4gx-8jhr
- GO-2026-6021

## Timeline

- 2026-06-25: advisory: NVD published date
- 2026-07-20: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/babakizo420](https://api.github.com/users/babakizo420)
- [https://github.com/babakizo420](https://github.com/babakizo420)
- [https://api.github.com/users/babakizo420/gists%7B/gist_id%7D](https://api.github.com/users/babakizo420/gists%7B/gist_id%7D)
- [https://api.github.com/users/babakizo420/repos](https://api.github.com/users/babakizo420/repos)
- [https://avatars.githubusercontent.com/u/170581725?v=4](https://avatars.githubusercontent.com/u/170581725?v=4)
- [https://api.github.com/users/babakizo420/events%7B/privacy%7D](https://api.github.com/users/babakizo420/events%7B/privacy%7D)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)