Lexdotdev

**Name of the Vulnerable Software and Affected Versions** File Browser versions prior to 2.63.16 **Description** A scoped, non-admin user with only Create permissions can delete arbitrary files outside their assigned scope, including other tenants' data and the application database. This occurs during the upload failure-cleanup process in the direct-upload handler. The issue stems from the `ScopedFs.RemoveAll()` function, which fails to enforce the symlink guard used by other methods. If a directory symlink that escapes the scope already exists within the user's directory, an authenticated user can trigger a failed upload to execute `ScopedFs.RemoveAll()` on a user-controlled path, bypassing both the ScopedFs boundary and the delete permission requirement. **Recommendations** Update File Browser to version 2.63.16.