CVE-2026-55668: File Browser Symlink Scope Bypass – Authentication Required

Technical summary

The vulnerability stems from improper scope validation in ScopedFs, File Browser's access control mechanism. The flaw occurs in a two-step process: (1) validation checks the closest existing ancestor of a dangling symlink to confirm it is within scope, and (2) during file creation, the symlink is followed, bypassing the scope boundary. This is a classic symlink-following attack pattern (CWE-59) combined with a path traversal vulnerability (CWE-22). An authenticated user with Create and Modify permissions can craft a symlink pointing to a location outside their scope, pass the ancestor validation, and then create or modify files at the target location. The vulnerability requires the attacker to already have authenticated access and explicit Create/Modify permissions, limiting the attack surface to internal or trusted users with elevated privileges within the application.

Business impact

This vulnerability allows authenticated users to breach file isolation boundaries within File Browser deployments. In multi-tenant or role-based environments, a user could write files to directories belonging to other users or system-critical areas, potentially causing data corruption, configuration tampering, or privilege escalation. Organizations using File Browser for sensitive document management, shared hosting, or departmental file sharing face a direct risk to data integrity and confidentiality. The medium CVSS score reflects that exploitation requires prior authentication and explicit permissions, but the impact on file integrity can be severe depending on what files are written and where.

Affected systems

File Browser versions prior to 2.63.16 are affected. Organizations should verify their deployed version immediately. The vulnerability affects all installations regardless of operating system or deployment model (self-hosted, cloud, or containerized), as the flaw is in the core application logic rather than an OS-specific component.

Exploitability

Exploitation requires an authenticated user account with Create and Modify permissions on the File Browser instance. An attacker must understand the target directory structure to craft an effective symlink path. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:C) indicates network accessibility, high attack complexity (reflecting the need to identify suitable symlink targets), and low privilege requirements (authenticated user). No user interaction is required; the attack is automated once the symlink is placed. The issue is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, but the exploit logic is straightforward for anyone with internal knowledge of the application's file layout.

Remediation

Upgrade File Browser to version 2.63.16 or later. This version corrects the scope validation logic to prevent symlink-following attacks by performing validation at the point of file creation, not just on the symlink's ancestor. Apply the patch across all instances—both production and development environments—since the vulnerability can be exploited in any environment where a user has Create and Modify permissions.

Patch guidance

1. Test version 2.63.16 in a non-production environment to confirm compatibility with your deployment and any custom configurations. 2. Back up your File Browser configuration and data before upgrading. 3. Plan a maintenance window and coordinate with users to minimize disruption. 4. Deploy the patch to all instances (primary, replicas, and backups). 5. Verify the upgrade by checking the application version and testing file creation within scope to confirm normal operations are not affected. 6. Review any active sessions or processes that may be holding file handles; restart the application if necessary.

Detection guidance

Monitor File Browser audit logs and filesystem access logs for patterns indicative of scope violation: - Creation of files outside a user's designated directory tree, especially by users with Create/Modify permissions. - Symlink creation followed by file write operations in unexpected locations. - Multiple failed file creation attempts in quick succession (potential reconnaissance). - Look for file paths containing '..' or symlink references in the request logs. Implement filesystem-level monitoring to alert on unauthorized writes to sensitive directories. If your File Browser instance is containerized, enable container runtime security monitoring to detect process-level file system calls that violate expected access patterns.

Why prioritize this

This vulnerability merits timely patching because it enables authenticated users to escape file scope boundaries and write arbitrary content to unintended locations. While it requires prior authentication and explicit permissions, the impact on data integrity is direct and potentially severe in shared or multi-tenant environments. The straightforward nature of the exploit (symlink placement) makes it a realistic threat from insider threats or compromised accounts. Patch deployment should be prioritized for environments where File Browser stores sensitive data or serves multiple users with different access levels.

Risk score, explained

The CVSS 3.1 score of 6.3 (MEDIUM) reflects a moderate overall risk. Attack Vector (Network) and Scope Change (affects resources beyond the vulnerable component) elevate the score, but the requirement for prior authentication (PR:L) and high attack complexity (AC:H) temper it. The integrity impact is high (an attacker can modify files), but there is no confidentiality or availability impact. For organizations using File Browser in multi-user or multi-tenant scenarios, the practical risk may be higher than the base score suggests; consider raising priority if users have access to sensitive data.

Frequently asked questions