Is CVE-2026-73613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73613 being exploited in the wild.

How severe is CVE-2026-73613?

High severity, with a CVSS score of 8.2, published 13 August 2026.

Is there a fix for CVE-2026-73613?

A patch was published on 2026-08-31: Patched in version 2.63.19; repository archived Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-73613 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-73613?

Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73613: filebrowser out-of-scope file deletion via symlink in TUS cache eviction

CVE-2026-73613 · Severity: high · CVSS 8.2 · Published 2026-08-13

filebrowser is a web-based file manager that allows users to browse and manage files with role-based permissions. A vulnerability in the TUS upload cache mechanism allows authenticated users with only file creation rights to delete arbitrary files outside their authorized scope—including other users' data or the application database—by exploiting a race condition with symlinks during cache cleanup.

Technologies: Filebrowser. Vendors: FileBrowser.

Quick answers

Is CVE-2026-73613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73613 being exploited in the wild.
How severe is CVE-2026-73613?: High severity, with a CVSS score of 8.2, published 13 August 2026.
Which products and versions are affected?: Filebrowser before 2.63.19.
Is there a fix for CVE-2026-73613?: A patch was published on 2026-08-31: Patched in version 2.63.19; repository archived Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-73613 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-73613?: Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a symlink-following flaw (CWE-59) in the TUS upload cache eviction mechanism. When a TUS upload POST request is registered, its absolute path is stored in an in-memory cache without resolving symlinks. When the cache entry expires after 3 minutes (uploadCacheTTL), an OnEviction callback executes a raw os.Remove() on a background goroutine, bypassing filebrowser's ScopedFs scope guards and permission checks. An attacker with Perm.Create can initiate a TUS upload, then during the TTL window swap an ancestor directory with a symlink pointing outside the user's authorized scope. The subsequent os.Remove() follows the symlink and deletes the out-of-scope target. The fix (patched in 2.63.19) adds guard() calls to route the cache eviction through ScopedFs scope validation rather than using raw filesystem operations.

Affected products

filebrowser filebrowser before 2.63.19

Timeline

2026-07-27: disclosed: GitHub Security Advisory GHSA-m9f5-2232-frp6 published
2026-08-13: advisory: CVE-2026-73613 published on NVD
2026-08-31: patched: Patched in version 2.63.19; repository archived

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.