CVE-2026-55667: File Browser Privilege Escalation – Symlink Bypass Enables Arbitrary File Deletion

Technical summary

The vulnerability stems from inconsistent symlink handling across File Browser's ScopedFs implementation. While most file operations enforce a symlink guard to prevent scope escape, the RemoveAll function does not check for symlinks before dereferencing paths. During upload failures, the direct-upload handler calls RemoveAll on a user-controlled cleanup path, gated only by Perm.Create permission. If an attacker pre-positions a directory symlink pointing outside the user's scope within their own scoped directory, the failed-upload cleanup will follow that symlink and delete the out-of-scope target. This bypasses both the ScopedFs boundary isolation and the explicit Perm.Delete permission gate. The attack requires the symlink to already exist in the user's scope and a failed upload to trigger the cleanup path.

Business impact

Multi-tenant deployments are at severe risk. A low-privilege user account in one tenant can destroy data belonging to other tenants or corrupt the application's core database, leading to data loss, service disruption, and potential compliance violations. Because the attack requires only Create permission and no admin access, the blast radius extends to any authenticated user, dramatically increasing the likelihood of exploitation. Organizations with strict least-privilege controls may inadvertently enable this attack if they grant Create-only roles to automation or untrusted users.

Affected systems

File Browser versions prior to 2.63.16 are affected. The vendor information was not included in the advisory; verify your deployment version and consult the File Browser release notes or vendor advisory for a complete list of affected versions and supported platforms.

Exploitability

Exploitation requires an authenticated account with Create-only permissions and the ability to pre-position a symlink within the user's scoped directory. The attacker must then trigger an upload failure to initiate the cleanup routine that follows the symlink. While not trivial—it requires both authentication and some filesystem setup—the attack is reliable once the symlink is in place and requires no special software or zero-day knowledge. The CVSS vector (AC:H) reflects the moderate complexity, but AC:H in this context refers to the need to pre-position the symlink and trigger a specific code path, not a requirement for exceptional circumstances.

Remediation

Upgrade to File Browser version 2.63.16 or later, which applies symlink guard checks to the RemoveAll operation, ensuring all ScopedFs methods enforce consistent path validation. After upgrading, audit for any suspicious file deletions in the application logs and verify that sensitive data in other tenants' scopes was not accessed during the vulnerability window.

Patch guidance

Apply File Browser 2.63.16 as soon as possible. Verify availability and compatibility in your environment by consulting the official File Browser release notes. Test the update in a non-production environment first to ensure no compatibility issues with custom configurations or integrations. The fix is a security-critical change that closes a privilege escalation and data destruction vector.

Detection guidance

Monitor for suspicious RemoveAll operations or failed uploads followed by unexpected file deletions outside a user's assigned scope. Examine audit logs for Create-permission users deleting files they should not have access to. Check for symlinks within user-scoped directories that point to sensitive locations (parent directories, database paths, other tenant folders). File integrity monitoring on critical application directories and database storage can alert to unauthorized modifications. If File Browser maintains detailed operation logs, search for patterns where low-privilege users trigger upload failures on paths containing directory traversal sequences.

Why prioritize this

This vulnerability should be patched urgently in multi-tenant environments. The combination of a low privilege requirement (Create-only), high-impact scope escape (any file in the system), and reliable exploit path makes it a critical priority. The CVSS score of 8.2 (HIGH) underestimates the practical severity in shared-tenant scenarios where data isolation is a core security assumption. No public exploit code or active attacks are reported (KEV status is false), but the straightforward nature of the attack makes it likely to be weaponized once widely known.

Risk score, explained

CVSS 8.2 (HIGH) reflects the severity correctly: the vulnerability requires low privilege (Perm.Create) and authentication, but has high impact (arbitrary file deletion across scopes, affecting both confidentiality indirectly through data loss and availability through database destruction). The AV:N (network-accessible) and S:C (scope change—affecting other tenants) elevate the score. AC:H acknowledges the need to pre-position a symlink, but this is a one-time setup cost that becomes a persistent threat. Organizations should treat this as critical despite the HIGH label due to its ability to compromise data isolation in multi-tenant deployments.

Frequently asked questions