Skip to content
Threat Feed
Subscribe

Product

Filebrowser (<= 2.63.15)

1 brief RSS
medium advisory

File Browser Symlink Following Vulnerability Allows Out-of-Scope File Deletion (CVE-2026-55667)

A File Browser user with only `Create` permission can exploit CVE-2026-55667, an incomplete fix for CVE-2026-54094, to delete arbitrary files and directories outside their authorized scope by abusing the `ScopedFs.RemoveAll` function's symlink-following behavior during failed upload cleanup, leading to data loss, cross-tenant data deletion, or denial of service.

filebrowser vulnerability file-browser symlink-attack data-loss denial-of-service
2t 2c