HIGH 7.6 NVD
CVE-2026-90930
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authe
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
References
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9
- https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symli
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9
This high severity vulnerability with a CVSS score of 7.6 was published on 2026-09-14 via NVD.
vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.