What’s Vulnerable › Vulnerabilities

CVE-2026-90930: File Browser through 2.63.23 Path Traversal via Symlink Alias

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-24
• Weakness: CWE-59

Description

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

Affected products

• filebrowser: through 2.63.23

References

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9
• https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9

Get alerted when CVE-2026-90930 or the next vulnerability affects your stack