CVE-2026-55667Disclosure

LOWCVSS 8.2 · HIGH

Signal is active with 2 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outside their scope (other tenants' data, and the application's own database) via the upload failure-cleanup path. ScopedFs.RemoveAll is the one dereferencing operation that skips the symlink guard every other method enforces. The direct-upload handler runs RemoveAll on the user-controlled path during failed-upload cleanup, gated only by Perm.Create. If an escaping directory symlink already exists inside the user's scope, an authenticated create-only user can delete an out-of-scope target, bypassing both the ScopedFs boundary and the Perm.Delete gate. This vulnerability is fixed in 2.63.16.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22CWE-59

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
2 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
Disclosure: 1 classified signal
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification2 categories

Disclosure

150.0%

Patch

150.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-55667

Full discourse2 posts

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters90d
Patch
#CVE-2026-55667 - Path Traversal in File Browser. Non-admin users with Create permission can delete arbitrary files outside scope. #CVSS 8.2. Unpatched. Restrict user permissions immediately. #CVEAlert #infosec #cybersecurity #devsecops #devops More detailed info: https://www.valtersit.com/cve/CVE-2026-55667
Post summary
The tweet announces CVE-2026-55667, a path traversal vulnerability that allows non‑admin creators to delete files; it notes the vulnerability is unpatched and urges users to restrict file permissions as a mitigation.
0000051
967 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨 HIGH - Arbitrary file deletion via symlink escape in upload cleanup (CVE-2026-55667) File Browser’s direct-upload handler (filebrowser) can be abused to delete files outside a user’s permitted scope during failed upload cleanup. The root cause is improper path/symlink validation in a filesystem cleanup routine: it calls ScopedFs.RemoveAll on a user-controlled path without the symlink guard, allowing a directory symlink to escape scope boundaries and bypass the delete permission check. An attacker only needs a scoped, non-admin account with Create permission and the ability to trigger a failed upload while an escaping symlink exists in their allowed directory. Impact includes arbitrary deletion of other tenants’ files and potentially the application’s database, resulting in severe data loss and denial of service. 👉 Affected: filebrowser < 2.63.16 | Upgrade to 2.63.16
Post summary
The post discloses a high‑severity symlink escape vulnerability (CVE‑2026‑55667) in File Browser that permits non‑admin users to delete arbitrary files, with a mitigation recommendation to upgrade to version 2.63.16.
0000065
231 followersView on X

Explore more

Back to dashboard