CVE-2026-55668— File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Possible ATT&CK Techniques 1AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.16 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-55668
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
Source: NVD (National Vulnerability Database)
Vulnerability Description
File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| filebrowser | filebrowser | < 2.63.16 | - |
II. Public POCs for CVE-2026-55668
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-55668
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-55668 (1)
Vendor Advisories for CVE-2026-55668 (1)
Vendor Pages for CVE-2026-55668 (1)
- 🔗 Release v2.63.16 · filebrowser/filebrowser · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: filebrowser
- CVE-2026-54090
File Browser: Command Allowlist Bypass via Shell Metacharact - CVE-2026-54088
File Browser: Command Injection via Authentication Hook Shel - CVE-2026-54089
File Browser: Authentication Bypass via Proxy Auth Header Fo - CVE-2026-54091
File Browser: Incorrect access control in public directory s - CVE-2026-54092
File Browser: DoS Vulnerability on Public Login API
Same vendor: filebrowser
- CVE-2026-54090
File Browser: Command Allowlist Bypass via Shell Metacharact - CVE-2026-54088
File Browser: Command Injection via Authentication Hook Shel - CVE-2026-54089
File Browser: Authentication Bypass via Proxy Auth Header Fo - CVE-2026-54091
File Browser: Incorrect access control in public directory s - CVE-2026-54092
File Browser: DoS Vulnerability on Public Login API
Same weakness: CWE-22
- CVE-2026-15138
tumf mcp-text-editor text_editor.py _validate_file_path path - CVE-2026-55878
Symfony: Path Traversal in symfony/ux-toolkit Allows Arbitra - CVE-2026-44024
Fluentd: Remote Code Execution (RCE) via Arbitrary File Writ - CVE-2026-58192
Appium: Unauthenticated arbitrary file/directory deletion in - CVE-2026-54590
AsyncSSH AuthorizedKeysFile username substitution bypass thr
V. Comments for CVE-2026-55668
No comments yet