high7.5
CVE-2026-54094
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
Impact
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/filebrowser/filebrowser/v2 | <= 2.63.13 | 2.63.14 |
| go | github.com/filebrowser/filebrowser | <= 1.11.0 | none recorded |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-239w-m3h6-ch8v
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-239w-m3h6-ch8v
- https://github.com/filebrowser/filebrowser/commit/7c2c0a11b31b2bb214d741005a0b02b1764208b3
- https://github.com/filebrowser/filebrowser/releases/tag/v2.63.14