File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope
Date: 2026-06
Affected: go/github.com/filebrowser/filebrowser, go/github.com/filebrowser/filebrowser/v2
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-54094
CWE: CWE-22
CWE-59
CVSS: 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)

## Summary File Browser enforces per-user scope with `afero.NewBasePathFs(afero.NewOsFs(), scope)`, set up in `users/users.go`. This blocks lexical `../` traversal, but it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. Two distinct shapes are covered here: - **Variant 1 — symlink as the final path component.** A symlink that lives inside the user's scoped tree and points to a file under the server root but outside the scope. The handlers record the symlink (`IsSymlink`) but then resolve and operate on the target anyway. - **Variant 2 — file or directory reached through a symlinked ancestor.** A regular file requested *through* a symlinked directory. Read, write (including TUS resumable uploads), share creation, and public-share serving are all affected. ## Impact In a multi-user deployment, if a symlink (a file symlink for Variant 1, or a directory symlink for Variant 2) exists inside a restricted user's scoped tree and resolves to a location outside that scope but reachable by the server process, the boundary can be crossed. Concretely, a user holding only normal File Browser permissions can: - Read out-of-scope file contents and metadata via `GET /api/raw/{path}` and `GE


Mitigations:

Architectural layers (MAESTRO):