CVE-2026-90930: File Browser Path Traversal Vulnerability

CVE-2026-90930 Overview

File Browser versions through 2.63.23 contain a path traversal vulnerability that allows authenticated users to bypass deny rules through symbolic link aliases. The application applies path rules to the requested lexical path but fails to reapply those rules after resolving symbolic links to their targets. Attackers can read and overwrite rule-denied files by accessing them through in-scope symlinks that resolve to denied paths. The flaw is tracked under CWE-59: Improper Link Resolution Before File Access.

Critical Impact
Authenticated users can bypass file access controls to read and modify restricted files, breaking the confidentiality and integrity guarantees of the deny rule system.

Affected Products

File Browser through version 2.63.23
Deployments relying on path-based deny rules for access control
Multi-tenant File Browser instances where users share filesystem scope

Discovery Timeline

2026-09-14 - CVE CVE-2026-90930 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90930

Vulnerability Analysis

File Browser enforces access controls by matching the requested path string against configured deny rules. When a user requests a path, the application checks the lexical path against the rule set, and if the check passes, it proceeds with the operation. The vulnerability arises because the application then dereferences symbolic links along the resolved path without reapplying the deny rule check to the final target.

This mismatch between the checked path and the accessed path enables a classic time-of-check to time-of-use style bypass rooted in unsafe symlink handling. An authenticated user with write access anywhere in scope can create or use a symlink that points to a rule-denied location. Subsequent read or write operations against the symlink alias succeed because only the alias path is evaluated against the rules.

The vulnerability affects both confidentiality and integrity. Attackers can exfiltrate sensitive files that administrators explicitly denied and can overwrite protected files with arbitrary content, potentially leading to configuration tampering or further compromise.

Root Cause

The root cause is incomplete access control enforcement in the path resolution pipeline. File Browser evaluates deny rules against the lexical (pre-resolution) path only. After symbolic links are followed, the resulting canonical path is not re-checked against the same policy, violating the principle of complete mediation.

Attack Vector

An authenticated user with low privileges initiates the attack over the network. The attacker identifies or creates a symbolic link within their permitted scope that points to a denied path. They then issue standard File Browser API calls (GET for read, PUT or PATCH for write) against the symlink alias. The server resolves the link, accesses the denied target, and returns or modifies the content on behalf of the attacker.

Exploitation requires valid credentials and pre-existing write access to a directory where symlinks can be created, or the presence of a usable symlink within scope. See the GitHub Security Advisory GHSA-7w29-q235-57m9 and the VulnCheck Path Traversal Advisory for further technical detail.

Detection Methods for CVE-2026-90930

Indicators of Compromise

File Browser access logs showing successful read or write operations on paths that resolve outside the user's expected scope
Creation of symbolic links inside user-writable directories that reference sensitive system paths such as /etc, /root, or application configuration directories
Unexpected modifications to files that should be protected by configured deny rules
API request patterns targeting paths that contain or traverse symlinked directories

Detection Strategies

Audit the filesystem scope managed by File Browser for symbolic links whose targets fall under deny-rule paths
Correlate File Browser HTTP access logs with filesystem-level access events to identify path mismatches between requested and resolved paths
Enable filesystem auditing (auditd on Linux) on directories referenced by deny rules and alert on access originating from the File Browser process

Monitoring Recommendations

Monitor for symlink creation events within File Browser managed directories using inotify or auditd rules
Track authenticated File Browser sessions that perform bulk read operations against unusual path patterns
Alert on any write operation to files that match protected paths in your File Browser rule configuration

How to Mitigate CVE-2026-90930

Immediate Actions Required

Inventory File Browser deployments and confirm whether any run version 2.63.23 or earlier
Restrict File Browser to trusted authenticated users only until a patched release is applied
Remove existing symbolic links from within File Browser managed directories that resolve to sensitive locations
Review deny rule configurations and validate that no in-scope symlink can reach a denied target

Patch Information

At the time of publication, refer to the GitHub Security Advisory GHSA-7w29-q235-57m9 for the vendor's remediation status and fixed version guidance. Upgrade to a release that resolves the symlink resolution issue as soon as one is available.

Workarounds

Run File Browser under a dedicated low-privilege operating system account that lacks read access to sensitive files, so kernel-level permissions enforce the intended boundary
Mount the File Browser scope directory with the nosymfollow option where supported, or use a filesystem layout that contains no symbolic links
Restrict user permissions within File Browser to remove the ability to create files in directories where symlinks could be introduced
Place File Browser inside a container or chroot whose filesystem view contains only the intended data, preventing symlinks from resolving to host paths

bash

# Example: mount the File Browser scope with nosymfollow (Linux 5.10+)
mount -o remount,nosymfollow /srv/filebrowser/data

# Example: run File Browser as an unprivileged user with a restricted scope
useradd -r -s /usr/sbin/nologin filebrowser
chown -R filebrowser:filebrowser /srv/filebrowser/data
sudo -u filebrowser filebrowser -r /srv/filebrowser/data