Description

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T12:17:26.043Z",
  "pubdate": "2026-08-13T12:17:26.043Z",
  "executiveSummary": "Filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability within the TUS upload cache eviction mechanism. This flaw permits authenticated users possessing only Create permissions to delete arbitrary files located outside their authorized scope, bypassing standard ScopedFs scope guards and Perm.Delete authorization checks.\nThe vulnerability represents a critical security risk as it allows privilege escalation via destructive file operations, enabling malicious actors to disrupt system availability or delete sensitive data outside their designated operational boundaries. Exploitation requires authenticated access with Create capabilities and the ability to manipulate directory structures using symbolic links within a precise temporal window.",
  "technicalDetails": "The vulnerability resides in the TUS upload cache eviction mechanism of Filebrowser, specifically affecting versions prior to 2.63.19. The root cause stems from an insecure implementation in the file cleanup routine where raw operating system remove calls, specifically os.Remove, are executed without properly validating the final resolved path against configured scope boundaries after traversal or manipulation.\nDuring the cache TTL window, an attacker with Create permissions can initiate a file operation and subsequently swap an ancestor directory with a symbolic link. When the TUS upload cache eviction mechanism triggers, it follows the newly introduced symlink. This redirects the raw os.Remove invocation to an out-of-scope target on the underlying filesystem.\nBecause the validation checks implemented by ScopedFs and Perm.Delete are evaluated prior to or bypassed during the asynchronous cache eviction and symlink resolution phase, the application fails to prevent the deletion of arbitrary files. The attack requires authentication, specifically utilizing the Create permission to initiate the sequence, followed by precise timing to substitute the directory with a symlink before the cache eviction mechanism executes its file removal logic."
}