Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90929— File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup

Quick assessment

Affected
filebrowser filebrowser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

File Browser 版本 2.5.0 至 2.63.23 存在一个授权逻辑错误，位于直接上传端点（ 中的 ）。与 TUS 上传处理程序不同，直接上传处理程序没有拒绝目标为已存在目录的请求：当带有 的 POST 请求指向一个目录时，会在 内部失败（因为目录无法以写入模式打开），随后的失败清理逻辑会在请求路径上调用 ，从而递归删除整棵目录树。该清理操作既未受 权限控制，也未应用 delete 和 patch 处理程序所执行的 规则遍历，因此，仅拥有默认 Create 和 Modify 权限的已认证非管理员用户可以

CVSS 8.1 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90929

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup
Source: CVE Program / CVE List V5
Vulnerability Description
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile (a directory cannot be opened for writing) and the failure-cleanup path then calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is gated by neither the Perm.Delete permission nor the checkDescendants rule walk applied by the delete and patch handlers, so an authenticated non-administrator holding only the default Create and Modify permissions can delete directories they are not authorized to delete, including rule-denied files within them. Deletion remains confined to the user's scope because ScopedFs.RemoveAll still enforces the scope guard. The faulty cleanup was introduced in v2.5.0; no patched version is available.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
filebrowser filebrowser 2.5.0 ~ 2.63.23 -

II. Public POCs for CVE-2026-90929

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90929

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-90929 (2)

Same Patch Batch · filebrowser · 2026-09-14 · 4 CVEs total

CVE-2026-90930 6.8 MEDIUM File Browser through 2.63.23 Path Traversal via Symlink Alias
CVE-2026-90927 6.5 MEDIUM filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
CVE-2026-90928 6.5 MEDIUM File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

IV. Related Vulnerabilities

Same product: filebrowser
Same vendor: filebrowser
Same weakness: CWE-863

V. Comments for CVE-2026-90929

No comments yet

Leave a comment