Quick answers
- Is CVE-2026-90929 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90929 being exploited in the wild.
- How severe is CVE-2026-90929?
- High severity, with a CVSS score of 8.1, published 14 September 2026.
- Which products and versions are affected?
- File Browser 2.5.0 to 2.63.23.
- Is there a fix for CVE-2026-90929?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90929 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-90929?
- Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an incorrect authorization flaw (CWE-863) in the direct-upload endpoint (resourcePostHandler in http/resource.go). When a POST request with ?override=true targets an existing directory, the handler fails to reject it (unlike the TUS upload handler). The writeFile function then fails to open a directory for writing, triggering a failure-cleanup path that calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup bypasses both the Perm.Delete permission check and the checkDescendants rule walk that the delete and patch handlers enforce. An authenticated attacker with only default Create and Modify permissions can exploit this to delete any directory within their scope. The vulnerability was introduced in v2.5.0 and remains unfixed; the project is no longer maintained and no patch will ship.
Affected products
- File Browser File Browser 2.5.0 to 2.63.23
Timeline
- 2026-09-14: disclosed
- 2026-08-31: advisory: GitHub Security Advisory GHSA-c4fr-5f24-4wrj published