Is CVE-2026-55668 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55668 being exploited in the wild.

How severe is CVE-2026-55668?

Medium severity, with a CVSS score of 6.3, published 8 July 2026.

Which products and versions are affected?

github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.15, SEMVER:introduced=0,fixed=2.63.16.

Is there a fix for CVE-2026-55668?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55668 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55668?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55668: File Browser path traversal via dangling symlink in ScopedFs

Q: Is there a fix for CVE-2026-55668?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55668 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55668?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55668 · Severity: medium · CVSS 6.3 · Published 2026-07-08

File Browser, a web-based file management utility, contains a security flaw that allows users to bypass their assigned folder restrictions. By using a specially crafted symbolic link that points to a non-existent file, an authorized user can create new files anywhere on the server that the application has permission to write to. This could allow an attacker to interfere with other users' data or potentially gain full control of the server if the application is running with high privileges.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-55668 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55668 being exploited in the wild.
How severe is CVE-2026-55668?: Medium severity, with a CVSS score of 6.3, published 8 July 2026.
Which products and versions are affected?: github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.15, SEMVER:introduced=0,fixed=2.63.16.
Is there a fix for CVE-2026-55668?: Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55668 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55668?: Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.16 or later
```
go get github.com/filebrowser/filebrowser/v2@v2.63.16
```

Technical details

The ScopedFs component in File Browser uses a within() guard to prevent directory traversal via symbolic links. However, when a symbolic link is 'dangling' (its target does not yet exist), the guard's logic walks up to the nearest existing ancestor directory to validate the path. Because the ancestor directory is typically within the user's scope, the guard incorrectly permits the operation. Subsequent calls to os.OpenFile(O_CREATE) follow the symlink at the OS level, creating the file at the out-of-scope target. This vulnerability requires the attacker to have 'Create' and 'Modify' permissions and the ability to place a dangling symlink within their scope. It is a patch-gap variant of a previous symlink confinement issue.

Affected products

filebrowser filebrowser/filebrowser/v2 <= 2.63.15

Identifiers

CVE-2026-55668
GHSA-8wc8-hf36-mjh9
GO-2026-6020

Timeline

2026-06-27: advisory: Initial GitHub Advisory published
2026-07-20: advisory: Advisory updated and published to database
2026-07-20: patched: Fixed in version 2.63.16

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.