Medium severity6.8NVD Advisory· Published Sep 14, 2026· Updated Sep 14, 2026

CVE-2026-90930

Description

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

Affected products

Filebrowser/Filebrowserinferred2 versions
<=2.63.23+ 1 more
- (no CPE)range: <=2.63.23
- (no CPE)range: <=2.63.23

Patches

Vulnerability mechanics

References

github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9nvd
www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-aliasnvd

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000