CVE-2026-90930
File Browser through 2.63.23 Path Traversal via Symlink Alias
- State
- Published
- Severity
- 7.6 High
- Published
- Sep 14, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 14, 2026
Description
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.6 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N | VulnCheck |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
filebrowserfilebrowser |
|
References
- GitHub Security Advisory (GHSA-7w29-q235-57m9)vendor-advisory
- VulnCheck Advisory: File Browser through 2.63.23 Path Traversal via Symlink Aliasthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.