# CVE-2026-90930: File Browser symlink alias path traversal bypass

Source: https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90930 · Severity: medium · CVSS 6.8 · Published 2026-09-14

File Browser is a file management system that allows authenticated users to access files within configured scope boundaries. The application applies access rules to the path that users request, but fails to reapply those rules after resolving symbolic links to their actual targets. An authenticated user can bypass file access restrictions by accessing denied files through symbolic link aliases that point to restricted areas, enabling unauthorized reading and modification of protected files.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser).

## Quick answers

**Is CVE-2026-90930 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90930 being exploited in the wild.

**How severe is CVE-2026-90930?** Medium severity, with a CVSS score of 6.8, published 14 September 2026.

**Which products and versions are affected?** File Browser through 2.63.23.

**Is there a fix for CVE-2026-90930?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90930 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90930?** Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a path traversal vulnerability (CWE-59) in symbolic link resolution. File Browser's authorization layer (CheckRules in http/data.go) applies deny rules to the lexical path requested by the user using regex or prefix matching, but the ScopedFs filesystem layer later resolves symbolic links to their actual targets without reapplying the deny rules. An authenticated non-administrator can read or overwrite files in rule-denied paths if those files are reachable through an in-scope symbolic link alias—both the link and target must remain within the user's assigned scope. The vulnerability requires the existence of a symbolic link pointing to denied content (typically created out-of-band by an administrator, or present in mounted volumes or restored backups), and the attacker must possess Download or Modify permissions. The project is unmaintained and no patch will be released.

## Affected products

- File Browser File Browser through 2.63.23

## Timeline

- 2026-08-31: disclosed
- 2026-09-14: advisory

## References

- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9)
- [https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias](https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias)

## Related threats

- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)
- [File Browser JWT expiration bypass in proxy authentication](https://junglewise.ai/threats/cve-2026-73611-file-browser-jwt-expiration-bypass-in-proxy-authentication)