CVE-2026-54094

MEDIUM SEVERITY

CVSS Score & Metrics

Base Score

6.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N                                    

Vulnerability Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.

Vulnerability Details

Published Date

June 12, 2026

Last Modified

June 25, 2026

CWE ID

CWE-22

Source

GitHub

Vendor

Product

github.com/filebrowser/filebrowser/v2

External References

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-239w-m3h6-ch8v
https://github.com/filebrowser/filebrowser/commit/7c2c0a11b31b2bb214d741005a0b02b1764208b3
https://github.com/filebrowser/filebrowser/releases/tag/v2.63.14
https://github.com/advisories/GHSA-239w-m3h6-ch8v

CVE-2026-54094

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment