Is CVE-2026-90930 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-90930 being exploited in the wild.

How severe is CVE-2026-90930?

Medium severity, with a CVSS score of 6.8, published 14 September 2026.

Is there a fix for CVE-2026-90930?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-90930 attacked?

It is attacked over the network.

Am I affected by CVE-2026-90930?

Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-90930: File Browser symlink alias path traversal bypass

CVE-2026-90930 · Severity: medium · CVSS 6.8 · Published 2026-09-14

File Browser is a file management system that allows authenticated users to access files within configured scope boundaries. The application applies access rules to the path that users request, but fails to reapply those rules after resolving symbolic links to their actual targets. An authenticated user can bypass file access restrictions by accessing denied files through symbolic link aliases that point to restricted areas, enabling unauthorized reading and modification of protected files.

Technologies: File Browser. Vendors: File Browser.

Quick answers

Is CVE-2026-90930 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-90930 being exploited in the wild.
How severe is CVE-2026-90930?: Medium severity, with a CVSS score of 6.8, published 14 September 2026.
Which products and versions are affected?: File Browser through 2.63.23.
Is there a fix for CVE-2026-90930?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-90930 attacked?: It is attacked over the network.
Am I affected by CVE-2026-90930?: Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a path traversal vulnerability (CWE-59) in symbolic link resolution. File Browser's authorization layer (CheckRules in http/data.go) applies deny rules to the lexical path requested by the user using regex or prefix matching, but the ScopedFs filesystem layer later resolves symbolic links to their actual targets without reapplying the deny rules. An authenticated non-administrator can read or overwrite files in rule-denied paths if those files are reachable through an in-scope symbolic link alias—both the link and target must remain within the user's assigned scope. The vulnerability requires the existence of a symbolic link pointing to denied content (typically created out-of-band by an administrator, or present in mounted volumes or restored backups), and the attacker must possess Download or Modify permissions. The project is unmaintained and no patch will be released.

Affected products

File Browser File Browser through 2.63.23

Timeline

2026-08-31: disclosed
2026-09-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.