Tag
Improper Authorization in File Browser Direct-Upload Endpoint
1 rule 1 TTP 1 CVEFile Browser versions 2.5.0 through 2.63.23 are vulnerable to an improper authorization flaw allowing authenticated users to trigger recursive directory deletion via the direct-upload endpoint.
File Browser Symlink Following Vulnerability Allows Out-of-Scope File Deletion (CVE-2026-55667)
2 TTPs 2 CVEsA File Browser user with only `Create` permission can exploit CVE-2026-55667, an incomplete fix for CVE-2026-54094, to delete arbitrary files and directories outside their authorized scope by abusing the `ScopedFs.RemoveAll` function's symlink-following behavior during failed upload cleanup, leading to data loss, cross-tenant data deletion, or denial of service.
FileBrowser Authentication Bypass via Forged Proxy Authentication Header
1 rule 3 TTPsAn unauthenticated attacker can impersonate any user, including administrators, or automatically create new user accounts in FileBrowser by forging the `X-Remote-User` HTTP header when the server is configured for proxy authentication and is directly reachable, leading to full administrative control and unauthorized access to data.
File Browser Proxy Authentication Bypass Vulnerability (CVE-2026-35607)
2 rules 1 TTP 1 CVEFile Browser versions before 2.63.1 improperly grant execution capabilities to new users created via proxy authentication, leading to privilege escalation.