CVE-2026-54094: File Browser Symlink Path Traversal (v2.63.14)

Technical summary

File Browser versions prior to 2.63.14 fail to perform symlink target validation in HTTP file handlers responsible for open, serve, write, share, and list operations. The vulnerability stems from following symbolic links without verifying that the resolved target path remains within the user's authorized scope. An attacker can craft a symlink whose lexical path satisfies scope checks but whose inode target does not, resulting in access to out-of-scope files. This is a classic path traversal variant (CWE-22) combined with unsafe symlink handling (CWE-59). The lack of authentication requirement in public-share scenarios amplifies the risk, allowing unauthenticated users to exploit the flaw if they possess a share link to a directory containing a symlink.

Business impact

This vulnerability enables unauthorized information disclosure and potential data modification. A scoped user or public-share recipient can access confidential files, source code, configuration files, or database credentials stored outside their intended directory. In multi-tenant or shared-hosting deployments, this could allow cross-user data access. The public-share variant means the flaw can be exploited without credentials, lowering the barrier to attack. Additionally, write access could allow file corruption or injection of malicious content if the symlink target is writable.

Affected systems

File Browser versions before 2.63.14 are affected. The advisory does not list specific downstream products that bundle this software. Organizations using File Browser in production environments should audit their deployments and upgrade immediately. This includes self-hosted instances and any third-party applications that embed File Browser as a dependency.

Exploitability

Exploitability is high. The attack requires no special privileges for authenticated users and no credentials at all for public-share recipients. Symlink creation is straightforward on most filesystems, and the HTTP handlers will follow them automatically without validation. The network-accessible nature (AV:N) and low attack complexity (AC:L) mean any remote attacker who can interact with the File Browser interface can attempt exploitation. No user interaction is required.

Remediation

Upgrade File Browser to version 2.63.14 or later immediately. This version patches the symlink validation logic, ensuring that resolved targets are checked against the user's authorized scope before access is granted. Organizations should also review access controls for their File Browser instances, restrict public-share functionality where possible, and audit logs for suspicious file access patterns that may indicate exploitation attempts.

Patch guidance

Apply File Browser version 2.63.14 or later. Verify the patch through the official project repository or vendor advisory to confirm the symlink-handling changes. Test the upgrade in a non-production environment first to ensure compatibility with existing deployments. After patching, restart the File Browser service to ensure the new handlers are active.

Detection guidance

Monitor File Browser logs and HTTP access logs for requests containing encoded symlinks (../, ..\, etc.) in file paths, particularly requests that resolve to files outside the configured scope directory. Watch for 404 or permission-denied errors followed by successful access to unexpected file paths, which may indicate symlink traversal attempts. File integrity monitoring tools can alert on unexpected symlink creation within File Browser directories. Network-level detection is difficult without deep packet inspection, so log analysis and behavioral monitoring are recommended.

Why prioritize this

This vulnerability scores 7.5 (HIGH) under CVSS 3.1, reflecting high confidentiality impact, network accessibility, and low barriers to exploitation. The lack of authentication requirements in public-share scenarios and the ease of symlink creation make this a practical attack vector. Organizations with File Browser exposed to untrusted networks or used in multi-tenant environments should prioritize patching within 24–48 hours.

Risk score, explained

CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects: Network-accessible attack vector, low attack complexity (symlinks are trivial to create), no privilege requirement, no user interaction, and high confidentiality impact (unauthorized file disclosure). Integrity and availability are not directly affected by this vulnerability, limiting the score from critical. The score would be higher if write or deletion permissions were granted by default.

Frequently asked questions