CVE-2026-90930

EUVD-2026-77448
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Link Following
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.8 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
filebrowserfilebrowser
𝑥
≤ 2.63.23
CNA
Common Weakness Enumeration
References
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9
https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9