Executive brief
filebrowser is a web-based file manager that allows users to browse and manage files with role-based permissions. A vulnerability in the TUS upload cache mechanism allows authenticated users with only file creation rights to delete arbitrary files outside their authorized scope—including other users' data or the application database—by exploiting a race condition with symlinks during cache cleanup.
Technical details
The vulnerability is a symlink-following flaw (CWE-59) in the TUS upload cache eviction mechanism. When a TUS upload POST request is registered, its absolute path is stored in an in-memory cache without resolving symlinks. When the cache entry expires after 3 minutes (uploadCacheTTL), an OnEviction callback executes a raw os.Remove() on a background goroutine, bypassing filebrowser's ScopedFs scope guards and permission checks. An attacker with Perm.Create can initiate a TUS upload, then during the TTL window swap an ancestor directory with a symlink pointing outside the user's authorized scope. The subsequent os.Remove() follows the symlink and deletes the out-of-scope target. The fix (patched in 2.63.19) adds guard() calls to route the cache eviction through ScopedFs scope validation rather than using raw filesystem operations.
Affected products
- filebrowser filebrowser before 2.63.19
Timeline
- 2026-07-27: disclosed: GitHub Security Advisory GHSA-m9f5-2232-frp6 published
- 2026-08-13: advisory: CVE-2026-73613 published on NVD
- 2026-08-31: patched: Patched in version 2.63.19; repository archived