CVE-2026-55667

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.16

Description A scoped, non-admin user with only Create permissions can delete arbitrary files outside their assigned scope, including other tenants' data and the application database. This occurs during the upload failure-cleanup process in the direct-upload handler. The issue stems from the ScopedFs.RemoveAll() function, which fails to enforce the symlink guard used by other methods. If a directory symlink that escapes the scope already exists within the user's directory, an authenticated user can trigger a failed upload to execute ScopedFs.RemoveAll() on a user-controlled path, bypassing both the ScopedFs boundary and the delete permission requirement.

Recommendations Update File Browser to version 2.63.16.