CVE-2026-55668

6.3 Moyenne

Publiée le 08/07/2026 à 17:16 · Modifiée le 08/07/2026 à 19:17 · Analyse NVD reportée · Source : security-advisories@github.com

Description

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.

Traduire en français

Produits concernés

filebrowser

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.3 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:N`

Faiblesses (CWE)

CWE-22
CWE-59

Références

https://github.com/filebrowser/filebrowser/commit/64511ce45e3be379e965f7f4fb0929a068d5bb81
https://github.com/filebrowser/filebrowser/releases/tag/v2.63.16
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories