CVE-2026-90930: File Browser through 2.63.23 Path Traversal via Symlink Alias
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
File Browserto a version that resolves this vulnerability.Fixed in 2.63.23Patch Path Traversal via Symlink Alias - Compensating control
For File Browser, restrict authenticated users’ ability to access/serve arbitrary files so they cannot exploit in-scope symbolic link aliases to reach rule-denied paths.
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated File Browser user can exploit it if they can access an in-scope symbolic link whose target is a path denied by configured rules. Exploitation requires bypassing the deny rules through that symlink alias.
What is the impact of a successful exploit?
An attacker can read and overwrite files that the File Browser deny rules are intended to block. The vulnerability does not indicate an availability impact.
Are default deployments affected?
The issue depends on deny rules and symbolic links that resolve from an allowed in-scope path to a denied target. The provided information does not establish whether a default configuration includes those conditions.
What should be checked while remediation is pending?
Review configured deny rules and identify in-scope symbolic links whose resolved targets fall under denied paths. Such links can provide authenticated users a route to read or overwrite files that should be blocked.