CVE-2026-90929

File Browser versions 2.5.0 through 2.63.23 contain an incorrect authorization flaw (CWE-863) in the direct-upload endpoint (resourcePostHandler in http/resource.go). When an authenticated user POSTs an upload with ?override=true targeting an existing directory, the write fails and the error-cleanup path calls Fs.RemoveAll on the request path, recursively deleting the entire directory tree. Because this cleanup bypasses both the Perm.Delete permission check and the checkDescendants rule walk used by the normal delete and patch handlers, a low-privileged user holding only the default Create and Modify permissions can delete directories they are not authorized to remove, including rule-denied files inside them; deletion remains confined to the user's scope. No patched version is currently available, and no public proof of concept or active exploitation is known.

What to do: No patched release exists yet, so audit and constrain access now: remove Create or Modify permissions from any untrusted or shared accounts, and review per-user rules for directories that must not be deletable. Monitor File Browser logs for POST requests with ?override=true aimed at directory paths, and consider a WAF or reverse-proxy rule blocking such requests. Reduce exposure by placing instances behind a VPN or SSO-authenticated proxy, and upgrade as soon as a fixed version above 2.63.23 is released.