CVE-2026-73613: filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filebrowserto a version that resolves this vulnerability.Fixed in 2.63.19
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73613?
CVE-2026-73613 has a severity rating of 8.2, which indicates a high level of risk.
How do I fix CVE-2026-73613?
To fix CVE-2026-73613, upgrade to Filebrowser version 2.63.19 or later.
What is the exploitability of CVE-2026-73613?
CVE-2026-73613 can be exploited by authenticated users with only Create permission due to an out-of-scope file deletion vulnerability.
What type of vulnerability is CVE-2026-73613?
CVE-2026-73613 is an out-of-scope file deletion vulnerability caused by improper handling of symlinks.
What are the potential impacts of CVE-2026-73613?
Exploitation of CVE-2026-73613 allows attackers to delete arbitrary files outside their permitted scope.