CVE-2026-90930

File Browser through version 2.63.23 enforces user path (deny) rules against the lexical path of a request, but when it resolves symbolic links it does not reapply those rules to the link's target. An authenticated user who can create or point to an in-scope symbolic link that aliases a rule-denied path can thereby bypass the deny rules. This allows the attacker to read and overwrite files that their permissions should have blocked. The flaw (CWE-59, improper link resolution before file access) affects any self-hosted File Browser deployment up to and including 2.63.23 that uses per-user path restrictions, and is rated high severity (CVSS 4.0: 7.6) because it requires only low privileges but can fully compromise confidentiality and integrity of the protected files. No public proof-of-concept or in-the-wild exploitation is currently known.

What to do: Upgrade File Browser to a release newer than 2.63.23 as soon as a fix is published. In the interim, audit any in-scope directories for symbolic links pointing to rule-denied paths and remove or restrict the ability of untrusted users to create symlinks. Review file-access logs for authenticated users who accessed files outside their permitted scope via alias paths.