Description

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-14T13:19:31.190Z",
  "pubdate": "2026-09-14T13:19:31.190Z",
  "executiveSummary": "File Browser versions through 2.63.23 are susceptible to a path traversal vulnerability stemming from improper validation of symbolic links. The vulnerability allows authenticated users to bypass defined path access controls and interact with files outside of authorized directory scopes.\nThe vulnerability occurs because the application performs path rule enforcement on the initial lexical path provided by the user but fails to re-evaluate these rules after resolving symbolic links to their underlying targets. This discrepancy enables an attacker to manipulate the filesystem by accessing, reading, or overwriting sensitive files that are explicitly restricted by policy.\nSuccessful exploitation requires authenticated access to the File Browser interface. By creating or leveraging existing symbolic links within an authorized directory that point to denied or restricted locations, an attacker can effectively escalate their access privileges to restricted areas of the filesystem. This poses a significant risk to data confidentiality and integrity, as restricted files become reachable through alias paths that the application's security mechanism perceives as legitimate. Organizations relying on File Browser's path-based access control are at risk of unauthorized data exposure and potential system compromise if sensitive configuration or data files are targeted.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the file path resolution logic within File Browser. When a request is processed, the application correctly identifies the lexical path and cross-references it against defined deny rules to enforce access restrictions. However, the logic fails to perform recursive or subsequent rule validation after the underlying operating system resolves a symbolic link to its target filesystem object.\nExploitation follows a specific sequence of operations. An authenticated attacker identifies a directory where they possess sufficient permissions to create or access files. If the environment permits the existence of symbolic links, the attacker creates a link that references a restricted or 'denied' file path. When the attacker initiates a request to this symbolic link via the File Browser interface, the application validates the path of the link itself, finds no violation, and proceeds to resolve the symlink.\nBecause the application logic treats the symbolic link as a transparent alias, the final filesystem operation occurs on the target path without a secondary check against the application's deny rules. Consequently, the application effectively treats the forbidden target file as if it were the authorized symbolic link itself.\nThis vulnerability impacts all versions of File Browser through 2.63.23. The scope of the impact includes both read and write operations, meaning an attacker can exfiltrate data from restricted files or overwrite files to potentially achieve remote code execution, depending on the nature of the target files reachable via the filesystem hierarchy. The attack is restricted to authenticated users, but it does not require elevated administrative privileges within the application itself, as the bypass leverages the inherent trust the application places in resolved file paths. The exposure is confined to the filesystem context accessible to the user account running the File Browser process."
}