{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/filebrowser--2.63.15/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-55667"},{"cvss":7.5,"id":"CVE-2026-54094"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["filebrowser (\u003c= 2.63.15)"],"_cs_severities":["medium"],"_cs_tags":["vulnerability","file-browser","symlink-attack","data-loss","denial-of-service"],"_cs_type":"advisory","_cs_vendors":["filebrowser"],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-55667, has been identified in File Browser versions up to 2.63.15, allowing a non-admin user with only \u003ccode\u003eCreate\u003c/code\u003e permissions to delete arbitrary files and directories outside their designated scope. This flaw is an incomplete fix for CVE-2026-54094 and stems from the \u003ccode\u003eScopedFs.RemoveAll\u003c/code\u003e function's failure to properly guard against symlink following during the cleanup process for failed uploads. Attackers can leverage a pre-existing, out-of-band planted symlink within their scope to trick the application into deleting sensitive files, potentially including other tenants' data or the application's own database. This can lead to data integrity compromises, cross-tenant data deletion, and a full denial of service for the File Browser instance. The vulnerability affects instances deployed on Linux-based systems where symlink creation and following are possible.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003ePrecondition Fulfillment\u003c/strong\u003e: An attacker ensures an escaping directory symlink (e.g., \u003ccode\u003e/scope/link\u003c/code\u003e pointing to \u003ccode\u003e/out-of-scope\u003c/code\u003e) is present within the user's File Browser scope. This symlink must be planted out-of-band as File Browser offers no symlink creation API.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: The attacker obtains authenticated access as a non-admin File Browser user with \u003ccode\u003ePerm.Create=true\u003c/code\u003e enabled and \u003ccode\u003ePerm.Delete=false\u003c/code\u003e (delete permission is not required for exploitation).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eMalicious Request\u003c/strong\u003e: The attacker sends an HTTP POST request to the File Browser \u003ccode\u003e/api/resources\u003c/code\u003e endpoint, attempting to \u0026quot;upload\u0026quot; a file to a path under the controlled symlink (e.g., \u003ccode\u003ePOST /api/resources/link/victim.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eContainment Bypass Attempt\u003c/strong\u003e: File Browser's \u003ccode\u003eresourcePostHandler\u003c/code\u003e attempts to process the upload. The initial file info validation (\u003ccode\u003eNewFileInfo\u003c/code\u003e) for the out-of-scope target fails, and the subsequent \u003ccode\u003ewriteFile\u003c/code\u003e operation is correctly blocked by \u003ccode\u003eScopedFs\u003c/code\u003e containment, resulting in a 403 HTTP response.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eFailure-Cleanup Trigger\u003c/strong\u003e: Due to the failed write, the \u003ccode\u003eresourcePostHandler\u003c/code\u003e triggers an internal cleanup routine at \u003ccode\u003ehttp/resource.go:173\u003c/code\u003e, which calls \u003ccode\u003ed.user.Fs.RemoveAll(r.URL.Path)\u003c/code\u003e on the user-controlled, unvalidated path (\u003ccode\u003e/link/victim.txt\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSymlink Dereference and Deletion\u003c/strong\u003e: The \u003ccode\u003eScopedFs.RemoveAll\u003c/code\u003e function, which uniquely lacks the necessary \u003ccode\u003eguard()\u003c/code\u003e mechanism unlike other methods, dereferences the pre-existing symlink (e.g., \u003ccode\u003e/link\u003c/code\u003e pointing to \u003ccode\u003e/tmp/fb-out\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact Achieved\u003c/strong\u003e: The \u003ccode\u003eRemoveAll\u003c/code\u003e function proceeds to delete the target file (e.g., \u003ccode\u003e/tmp/fb-out/victim.txt\u003c/code\u003e) or recursively delete contents if the target is a directory, leading to data loss or denial of service.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-55667 allows an authenticated File Browser user with only \u003ccode\u003eCreate\u003c/code\u003e permissions to destroy any file or directory that the File Browser process has access to, provided an escaping symlink exists within their scope. This leads to severe consequences such as data integrity loss, cross-tenant data deletion in multi-tenant environments, and full denial of service if the application's database directory is targeted. The vulnerability bypasses both the \u003ccode\u003eScopedFs\u003c/code\u003e boundary designed to contain user actions and the \u003ccode\u003ePerm.Delete\u003c/code\u003e gate, enabling low-privileged users to perform high-privileged destructive operations.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-55667 by upgrading File Browser to a version greater than 2.63.15, which addresses the incomplete fix of CVE-2026-54094.\u003c/li\u003e\n\u003cli\u003eRegularly review file system permissions for the File Browser process to ensure it operates with the principle of least privilege, reducing the blast radius of potential exploits.\u003c/li\u003e\n\u003cli\u003eEnsure robust backup and recovery procedures are in place for File Browser data and any managed files to mitigate the impact of data deletion.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T21:23:50Z","date_published":"2026-07-20T21:23:50Z","id":"https://feed.craftedsignal.io/briefs/2026-07-filebrowser-symlink/","summary":"A File Browser user with only `Create` permission can exploit CVE-2026-55667, an incomplete fix for CVE-2026-54094, to delete arbitrary files and directories outside their authorized scope by abusing the `ScopedFs.RemoveAll` function's symlink-following behavior during failed upload cleanup, leading to data loss, cross-tenant data deletion, or denial of service.","title":"File Browser Symlink Following Vulnerability Allows Out-of-Scope File Deletion (CVE-2026-55667)","url":"https://feed.craftedsignal.io/briefs/2026-07-filebrowser-symlink/"}],"language":"en","title":"CraftedSignal Threat Feed - Filebrowser (\u003c= 2.63.15)","version":"https://jsonfeed.org/version/1.1"}