https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T08:12:20.195397+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-54094 CVE-2026-54094 — File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope 2026-10-08T08:12:20.196562+00:00

Affected: filebrowser

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.