Executive brief
File Browser, a web-based file management utility, contains a security flaw that allows users to bypass their assigned folder restrictions. By using a specially crafted symbolic link that points to a non-existent file, an authorized user can create new files anywhere on the server that the application has permission to write to. This could allow an attacker to interfere with other users' data or potentially gain full control of the server if the application is running with high privileges.
Technical details
The ScopedFs component in File Browser uses a within() guard to prevent directory traversal via symbolic links. However, when a symbolic link is 'dangling' (its target does not yet exist), the guard's logic walks up to the nearest existing ancestor directory to validate the path. Because the ancestor directory is typically within the user's scope, the guard incorrectly permits the operation. Subsequent calls to os.OpenFile(O_CREATE) follow the symlink at the OS level, creating the file at the out-of-scope target. This vulnerability requires the attacker to have 'Create' and 'Modify' permissions and the ability to place a dangling symlink within their scope. It is a patch-gap variant of a previous symlink confinement issue.
Affected products
- filebrowser filebrowser/filebrowser/v2 <= 2.63.15
Timeline
- 2026-06-27: advisory: Initial GitHub Advisory published
- 2026-07-20: advisory: Advisory updated and published to database
- 2026-07-20: patched: Fixed in version 2.63.16