CVE-2026-55668 Details
Description
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
A vulnerability in File Browser's ScopedFs component prior to version 2.63.16 allows authenticated users with Create and Modify permissions to exploit dangling symlinks. The issue arises because ScopedFs incorrectly validates the scope of these symlinks, enabling the creation of files outside the user's designated area. This vulnerability is particularly concerning in multi-user environments, where it could lead to cross-tenant file manipulation.
Users can update to File Browser version 2.63.16 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 8, 2026CISA-ADP
Assessed Jul 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/filebrowser/filebrowser/commit/64511ce45e3be379e965f7f4fb0929a068d5bb81 | [email protected] | Source CodeVendor |
| https://github.com/filebrowser/filebrowser/releases/tag/v2.63.16 | [email protected] | Release NotesVendor |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| File Browser | <= 2.63.15 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 8, 2026 | CVE Modified | CISA-ADP |
| Jul 8, 2026 | New CVE Received | [email protected] |