CyberRota Analysis
AI-GeneratedFilebrowser versions prior to 2.63.19 are vulnerable to a file deletion flaw that allows authenticated users with only Create permissions to delete arbitrary files outside their intended scope. This vulnerability arises from the TUS upload cache eviction mechanism, where attackers can exploit symlink manipulation to bypass security checks. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized file deletions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.