CVE-2026-55668: File Browser Path Traversal Vulnerability

CVE-2026-55668 Overview

CVE-2026-55668 is a path traversal vulnerability [CWE-22] in File Browser, an open-source web file management interface. The flaw exists in the ScopedFs implementation, which validates the nearest existing ancestor of a dangling symbolic link as within scope, then follows the symlink during file creation. An authenticated user holding Create and Modify permissions can write attacker-controlled files outside their assigned scope. The issue affects File Browser versions prior to 2.63.16 and is resolved in that release.

Critical Impact
Authenticated users with basic file permissions can write files to arbitrary locations on the host filesystem, bypassing the scope isolation that File Browser relies on for multi-user separation.

Affected Products

File Browser versions prior to 2.63.16
Deployments exposing multi-user access with Create and Modify permissions
Instances relying on ScopedFs for per-user directory isolation

Discovery Timeline

2026-07-08 - CVE-2026-55668 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-55668

Vulnerability Analysis

File Browser uses a ScopedFs wrapper over the afero filesystem abstraction to constrain each user to a specific directory. When resolving paths for write operations, ScopedFs walks upward from a target path to find the nearest existing ancestor and validates that ancestor is inside the user's scope. If the target path is a dangling symbolic link, that ancestor check passes because the symlink itself resides within scope, but the link target may point outside the scope. The subsequent file creation then follows the symlink and writes the file at the attacker-chosen destination.

The result is a symlink-based scope escape [CWE-22]. An authenticated user with Create and Modify permissions can plant a dangling symlink inside their scope pointing to any writable location on the host, then trigger a write that resolves through the link. This yields arbitrary file write outside the user's assigned directory.

Root Cause

The validation logic checked existing ancestors but did not evaluate the resolved target of dangling symlinks before following them during write operations. Scope enforcement and symlink resolution were not aligned.

Attack Vector

Exploitation requires network access to the File Browser instance and an authenticated account with Create and Modify permissions. The attacker creates a symbolic link inside their scope whose target is a path outside the scope, then issues a create or write operation against the link path. File Browser resolves the write to the external target, producing arbitrary file creation with the privileges of the File Browser process.

// Security patch in files/scoped.go
	_ afero.Lstater = (*ScopedFs)(nil)
)

// maxSymlinkHops bounds how many dangling symlinks within() will follow before
// giving up, so a pathological chain cannot loop forever. It mirrors the kernel
// MAXSYMLINKS limit; the operation is rejected once the bound is exceeded.
const maxSymlinkHops = 255

func NewScopedFs(source afero.Fs, path string) *ScopedFs {
	if s, ok := source.(*ScopedFs); ok {
		source = s.base

Source: GitHub Commit 64511ce. The patch bounds dangling symlink traversal and tightens scope validation on write and delete paths.

Detection Methods for CVE-2026-55668

Indicators of Compromise

Unexpected symbolic links appearing inside user-scoped directories, particularly links whose targets resolve outside the scope root.
File writes by the File Browser process to paths outside configured user scopes.
New or modified files owned by the File Browser service account in system directories, configuration paths, or other user scopes.

Detection Strategies

Audit filesystem activity from the File Browser process for symlink, symlinkat, and openat system calls that resolve outside the configured scope roots.
Compare File Browser access logs recording Create and Modify actions against filesystem write events on the host, flagging writes that land outside the requesting user's scope directory.
Perform periodic scans of scope directories for dangling symbolic links using find -xtype l.

Monitoring Recommendations

Enable verbose File Browser logging and forward events to a central log platform for correlation with host filesystem telemetry.
Monitor for unexpected files appearing in sensitive host paths such as /etc, /root, or File Browser configuration directories.
Alert on process-level writes by the File Browser binary to paths outside its declared data roots.

How to Mitigate CVE-2026-55668

Immediate Actions Required

Upgrade File Browser to version 2.63.16 or later on all instances.
Review existing user scope directories for suspicious symbolic links and remove any dangling links pointing outside the scope.
Audit accounts holding Create and Modify permissions and revoke access where it is not required.

Patch Information

The fix is available in File Browser 2.63.16. See the GitHub Release v2.63.16, the GitHub Security Advisory GHSA-8wc8-hf36-mjh9, and the remediation commit 64511ce for full details. The patch introduces a maxSymlinkHops bound and corrects scope validation on write and delete flows.

Workarounds

Restrict the Create and Modify permissions to trusted users until the upgrade is applied.
Run File Browser under a dedicated, unprivileged service account with filesystem access limited to the intended data root.
Deploy File Browser inside a container or chroot so the process cannot resolve symlinks to sensitive host paths.

bash

# Upgrade File Browser to the patched release
docker pull filebrowser/filebrowser:v2.63.16
docker stop filebrowser && docker rm filebrowser
docker run -d --name filebrowser \
  -v /srv/filebrowser/data:/srv \
  -v /srv/filebrowser/database.db:/database.db \
  --user 1000:1000 \
  filebrowser/filebrowser:v2.63.16

# Audit existing scopes for dangling symlinks
find /srv/filebrowser/data -xtype l -print