CVE-2026-73613

HIGH 8.2

filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.

CWE	CWE-59
Vendor	filebrowser
Product	filebrowser
Published	Aug 13, 2026

Stay Ahead of the Next One

Get instant alerts for filebrowser filebrowser

Be the first to know when new high vulnerabilities affecting filebrowser filebrowser are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

High

Affected Versions

filebrowser / filebrowser

0 < 2.63.19

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m9f5-2232-frp6 vulncheck.com: https://www.vulncheck.com/advisories/filebrowser-before-out-of-scope-file-deletion-via-symlink

Credits

🔍 manus-use hacdias