CVE-2026-90929: File Browser Authorization Bypass Vulnerability

CVE-2026-90929 Overview

CVE-2026-90929 is an incorrect authorization vulnerability [CWE-863] affecting File Browser versions >= 2.5.0 and <= 2.63.23. The flaw resides in the direct-upload endpoint resourcePostHandler in http/resource.go. When an authenticated user issues a POST request with ?override=true targeting an existing directory, the failure-cleanup path invokes Fs.RemoveAll on the request path. This recursively deletes the entire tree without checking the Perm.Delete permission or the checkDescendants rule walk. Authenticated non-administrators holding only the default Create and Modify permissions can destroy directories and rule-denied files within their scope. No patched version is available at disclosure time.

Critical Impact

An authenticated low-privileged user can recursively delete directories and rule-protected files they lack authorization to remove, causing data loss across the user's accessible scope.

Affected Products

• File Browser version 2.5.0 (introduction of the faulty cleanup path)
• File Browser versions 2.5.0 through 2.63.23
• All deployments exposing the direct-upload endpoint to authenticated non-administrator users

Discovery Timeline

• 2026-09-14 - CVE-2026-90929 published to the National Vulnerability Database (NVD)
• 2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90929

Vulnerability Analysis

The vulnerability lives in File Browser's HTTP resource handler for direct uploads. The direct-upload handler differs from the TUS upload handler in that it does not reject a target path that resolves to an existing directory. When the server receives a POST with the ?override=true query parameter aimed at a directory, the code reaches writeFile. That function cannot open a directory for writing and returns an error.

The failure branch then calls Fs.RemoveAll on the original request path to clean up any partial write. Because the target is a directory, RemoveAll walks the tree and removes every child recursively. The cleanup call bypasses the authorization checks applied elsewhere in the codebase, converting an upload error into a destructive delete operation. Scope enforcement via ScopedFs.RemoveAll still holds, so deletion remains confined to the caller's scope, but every file within that scope becomes reachable.

Root Cause

The root cause is a missing authorization check on the error-recovery path. The delete and patch handlers gate destructive operations behind the Perm.Delete permission and a checkDescendants rule walk that validates each nested file against the caller's ruleset. The direct-upload cleanup performs neither check. A user holding only Create and Modify permissions triggers a filesystem-level recursive delete through an upload error. This maps to CWE-863 (Incorrect Authorization).

Attack Vector

Exploitation requires network access and valid credentials for a non-administrator account with default Create and Modify permissions. The attacker sends a single authenticated POST request to the direct-upload endpoint. The request path resolves to a directory within the user's scope, and the override=true query parameter is set. The server attempts the write, fails inside writeFile, and executes the flawed cleanup. Consult the GitHub Security Advisory GHSA-c4fr-5f24-4wrj and the VulnCheck Advisory for File Browser for the full technical breakdown.

Detection Methods for CVE-2026-90929

Indicators of Compromise

• Unexpected POST requests to the direct-upload endpoint with ?override=true where the target path is an existing directory.
• Server logs showing writeFile errors immediately followed by RemoveAll operations on the same path.
• Sudden disappearance of directories or files that a user should not be able to delete under normal permission enforcement.

Detection Strategies

• Instrument File Browser reverse proxies or ingress controllers to log the full request URI, HTTP method, and authenticated user for all upload endpoints.
• Correlate application-level error logs referencing writeFile failures with subsequent filesystem deletion events on the same path.
• Baseline normal upload behavior per user and alert on POST requests where the target path matches a directory name rather than a new filename.

Monitoring Recommendations

• Enable audit logging on the filesystem hosting File Browser storage to capture recursive deletion events.
• Forward web server access logs and File Browser application logs to a centralized log platform for correlation and retention.
• Alert on any non-administrator account performing high-volume deletion or generating repeated upload failures against directory paths.

How to Mitigate CVE-2026-90929

Immediate Actions Required

• Restrict access to File Browser instances so only trusted users can authenticate, using network controls or an authenticating reverse proxy.
• Revoke or scope down Create and Modify permissions for non-administrator accounts until a fix is available.
• Ensure regular, tested backups of all File Browser storage directories to allow recovery from unauthorized recursive deletions.

Patch Information

No patched version of File Browser is available at the time of publication. The faulty cleanup was introduced in v2.5.0 and remains present through v2.63.23. Monitor the GitHub Security Advisory GHSA-c4fr-5f24-4wrj for a fixed release announcement.

Workarounds

• Block or filter POST requests to the direct-upload endpoint that include the override=true query parameter at a reverse proxy or web application firewall (WAF).
• Deploy File Browser behind a WAF rule that inspects request paths and rejects uploads whose target resolves to an existing directory.
• Reduce the blast radius by segmenting each user's scope to a narrowly defined directory containing only data that user owns.
• Consider replacing the direct-upload path with the TUS upload flow, which rejects directory targets and is not affected by the flawed cleanup.