CVE-2026-73613

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to 2.63.19

Description An issue exists in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their assigned scope. An attacker can replace an ancestor directory with a symlink during the cache TTL (Time To Live) window to redirect the os.Remove() function call to a target outside the intended scope, bypassing ScopedFs scope guards and Perm.Delete checks.

Recommendations Update to version 2.63.19 or later.