File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.
Affected: Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser
## Summary
File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/users.go`. This blocks lexical `../` traversal, but it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it.
Two distinct shapes are covered here:
- **Variant 1 — symlink as the final path component.** A symlink that lives inside the user's scoped tree and points to a file under the server root but outside the scope. The handlers record the symlink (`IsSymlink`) but then resolve and operate on the target anyway. - **Variant 2 — file or directory reached through a symlinked ancestor.** A regular file requested *through* a symlinked directory.
Read, write (including TUS resumable uploads), share creation, and public-share serving are all affected.
## Impact
In a multi-user deployment, if a symlink (a file symlink for Variant 1, or a directory symlink for Variant 2) exists inside a restricted user's scoped tree and resolves to a location outside that scope but reachable by the server process, the boundary can be crossed. Concretely, a user holding only normal File Browser permissions can:
- Read out-of-scope file contents and metadata via `GET /api/raw/{path}` and `G…