https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 06:16:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330381 EUVD-2026-330381 https://cve.radiocsirt.org/vuln/euvd-2026-330381 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54094 <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.</p> <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54094 https://cve.radiocsirt.org/vuln/ghsa-239w-m3h6-ch8v <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary</p> <p>File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/users.go`. This blocks lexical `../` traversal, but it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it.</p> <p>Two distinct shapes are covered here:</p> <p>- **Variant 1 — symlink as the final path component.** A symlink that lives inside the user&#39;s scoped tree and points to a file under the server root but outside the scope. The handlers record the symlink (`IsSymlink`) but then resolve and operate on the target anyway. - **Variant 2 — file or directory reached through a symlinked ancestor.** A regular file requested *through* a symlinked directory.</p> <p>Read, write (including TUS resumable uploads), share creation, and public-share serving are all affected.</p> <p>## Impact</p> <p>In a multi-user deployment, if a symlink (a file symlink for Variant 1, or a directory symlink for Variant 2) exists inside a restricted user&#39;s scoped tree and resolves to a location outside that scope but reachable by the server process, the boundary can be crossed. Concretely, a user holding only normal File Browser permissions can:</p> <p>- Read out-of-scope file contents and metadata via `GET /api/raw/{path}` and `G…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser</p> <p>## Summary</p> <p>File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/users.go`. This blocks lexical `../` traversal, but it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it.</p> <p>Two distinct shapes are covered here:</p> <p>- **Variant 1 — symlink as the final path component.** A symlink that lives inside the user&#39;s scoped tree and points to a file under the server root but outside the scope. The handlers record the symlink (`IsSymlink`) but then resolve and operate on the target anyway. - **Variant 2 — file or directory reached through a symlinked ancestor.** A regular file requested *through* a symlinked directory.</p> <p>Read, write (including TUS resumable uploads), share creation, and public-share serving are all affected.</p> <p>## Impact</p> <p>In a multi-user deployment, if a symlink (a file symlink for Variant 1, or a directory symlink for Variant 2) exists inside a restricted user&#39;s scoped tree and resolves to a location outside that scope but reachable by the server process, the boundary can be crossed. Concretely, a user holding only normal File Browser permissions can:</p> <p>- Read out-of-scope file contents and metadata via `GET /api/raw/{path}` and `G…</p> https://cve.radiocsirt.org/vuln/ghsa-239w-m3h6-ch8v