CVE-2026-55667— File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
Possible ATT&CK Techniques 1AI
T1565.003 · Runtime Data ManipulationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.16 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55667
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
Source: CVE Program / CVE List V5
Vulnerability Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
FileBrowser 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FileBrowser是filebrowser团队开源的一个文件管理界面，在指定的目录，它可以用来上传、删除、预览和编辑文件。 FileBrowser 2.63.16之前版本存在安全漏洞，该漏洞源于上传失败清理路径中的ScopedFs.RemoveAll绕过符号链接防护，可能导致经过身份验证的仅拥有Create权限的用户删除作用域外的任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| filebrowser | filebrowser | < 2.63.16 | - |
II. Public POCs for CVE-2026-55667
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 8035 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-55667
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-55667 (1)
Same Patch Batch · filebrowser · 2026-06-25 · 10 CVEs total
| CVE-2026-54089 | 9.1 CRITICAL | File Browser: Authentication Bypass via Proxy Auth Header Forgery |
| CVE-2026-54096 | 8.4 HIGH | File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existe |
| CVE-2026-54094 | 7.5 HIGH | File Browser: Symlink following lets scoped users read, overwrite, and share files outside |
| CVE-2026-54091 | 7.5 HIGH | File Browser: Incorrect access control in public directory shares via rule path rebasing |
| CVE-2026-54092 | 6.5 MEDIUM | File Browser: DoS Vulnerability on Public Login API |
| CVE-2026-54090 | File Browser: Command Allowlist Bypass via Shell Metacharacter Injection | |
| CVE-2026-54088 | File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentica | |
| CVE-2026-54093 | File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators | |
| CVE-2026-54097 | File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in De |
IV. Related Vulnerabilities
Same product: filebrowser
- CVE-2026-62684
File Browser: Share API exposes the password hash and bypass - CVE-2026-72838
FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload - CVE-2026-72837
File Browser before 2.63.20 Privilege Escalation via Proxy A - CVE-2026-72836
FileBrowser before 2.63.19 Case Sensitivity Authentication B - CVE-2026-72835
filebrowser before v2.63.21 Access Rule Bypass via Path Cano
Same vendor: filebrowser
- CVE-2026-62684
File Browser: Share API exposes the password hash and bypass - CVE-2026-72838
FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload - CVE-2026-72837
File Browser before 2.63.20 Privilege Escalation via Proxy A - CVE-2026-72835
filebrowser before v2.63.21 Access Rule Bypass via Path Cano - CVE-2026-72836
FileBrowser before 2.63.19 Case Sensitivity Authentication B
Same weakness: CWE-22
- CVE-2026-76606
Joomla Extension - fabrikar.com - Path Traversal via image e - CVE-2026-63312
NLTK StreamBackedCorpusView Bypasses pathsec.ENFORCE Arbitra - CVE-2026-62383
nltk IPIPANCorpusReader Symlink Arbitrary File Read - CVE-2026-62384
NLTK FramenetCorpusReader Symlink Sandbox Bypass before 3.10 - CVE-2026-71514
NLTK 3.9.4 through 3.10.2 Path Traversal via CrubadanCorpusR
V. Comments for CVE-2026-55667
No comments yet