https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 22:41:26 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-334008 EUVD-2026-334008 https://cve.radiocsirt.org/vuln/euvd-2026-334008 https://cve.radiocsirt.org/vuln/fkie_cve-2026-55668 <p>File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user&#39;s scope. This issue is fixed in version 2.63.16.</p> <p>File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user&#39;s scope. This issue is fixed in version 2.63.16.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-55668 https://cve.radiocsirt.org/vuln/ghsa-8wc8-hf36-mjh9 <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>## Summary</p> <p>`ScopedFs` confines every File Browser user to a scope directory. Its `within()` guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a dangling symlink (target does not exist), the nearest existing ancestor is the in-scope directory containing the link, so the guard returns &#34;in scope&#34; and the subsequent `os.OpenFile(O_CREATE)` follows the link and creates the file at its out-of-scope target.</p> <p>A post-auth user with `Create` and `Modify` permission can write attacker-controlled content to any non-existent path outside their scope that the File Browser process can write to. The precondition is a dangling symlink present inside the user&#39;s scope, which is the same out-of-band precondition the rest of `ScopedFs` is built to defend against.</p> <p>This is a patch-gap variant of the GHSA-239w-m3h6-ch8v symlink confinement issue, not a resubmission of the already-published vulnerable-version behavior: GHSA-239w-m3h6-ch8v marks `&lt;= 2.63.13` vulnerable and `2.63.14` patched, while this proof reproduces on current `master` / `v2.63.15` (`be23ab3a15bf957928ecfed88de5ab67850c1b9c`). The escaping-symlink-to-an-existing-target case is defended and tested. The dangling case is neither, and the gap is acknowledged in a code comment as &#34;best-effort&#34;.</p> <p>## Root cause</p> <p>`files/scoped.go` (commit `be23ab3`). The guard, including the ma…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>## Summary</p> <p>`ScopedFs` confines every File Browser user to a scope directory. Its `within()` guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a dangling symlink (target does not exist), the nearest existing ancestor is the in-scope directory containing the link, so the guard returns &#34;in scope&#34; and the subsequent `os.OpenFile(O_CREATE)` follows the link and creates the file at its out-of-scope target.</p> <p>A post-auth user with `Create` and `Modify` permission can write attacker-controlled content to any non-existent path outside their scope that the File Browser process can write to. The precondition is a dangling symlink present inside the user&#39;s scope, which is the same out-of-band precondition the rest of `ScopedFs` is built to defend against.</p> <p>This is a patch-gap variant of the GHSA-239w-m3h6-ch8v symlink confinement issue, not a resubmission of the already-published vulnerable-version behavior: GHSA-239w-m3h6-ch8v marks `&lt;= 2.63.13` vulnerable and `2.63.14` patched, while this proof reproduces on current `master` / `v2.63.15` (`be23ab3a15bf957928ecfed88de5ab67850c1b9c`). The escaping-symlink-to-an-existing-target case is defended and tested. The dangling case is neither, and the gap is acknowledged in a code comment as &#34;best-effort&#34;.</p> <p>## Root cause</p> <p>`files/scoped.go` (commit `be23ab3`). The guard, including the ma…</p> https://cve.radiocsirt.org/vuln/ghsa-8wc8-hf36-mjh9