7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-54094

CVE-2026-54094: File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-54094

CVE-2026-54094:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/filebrowser/filebrowser/v2	go	<= 2.63.13	2.63.14
github.com/filebrowser/filebrowser	go	<= 1.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of symbolic links (symlinks) within the File Browser application. The application uses a scoped filesystem for each user to restrict their access to a specific directory. However, this scoping mechanism, which was based on afero.NewBasePathFs, only prevented lexical path traversal (i.e., using ../) and did not prevent the underlying operating system from following symlinks that pointed to files or directories outside the user's scope.

The patch for this vulnerability introduces a new filesystem layer called ScopedFs. This new layer wraps the standard filesystem operations (like opening, stating, or writing files) and, before each operation, it resolves any symlinks in the path to get the real, on-disk location of the target. It then checks if this resolved path is within the user's allowed scope. If it is not, the operation is denied with a permission error. This ScopedFs is now used for all user filesystem access, effectively closing the symlink vulnerability across the entire application.

The identified vulnerable functions are the HTTP handlers and file utility functions that were performing file operations without this crucial symlink validation. The patch removes the old, flawed checks from these functions and relies on the new, centralized ScopedFs to enforce security. The functions listed in vulnerable_functions are the key points where an attacker could trigger the vulnerability to read, write, or share files outside their intended scope.

Vulnerable functions

files.stat

files/file.go

The `stat` function in `files/file.go` was responsible for retrieving file information. Before the patch, it contained a flawed check for path traversal using symlinks. An attacker could create a symlink within their allowed directory that points to a file or directory outside of their scope. When `stat` was called on a path that used this symlink, the check was insufficient to prevent the symlink from being followed, leading to information disclosure about the target file.

http.writeFile

http/resource.go

The `writeFile` function in `http/resource.go` handles file uploads and modifications. It was vulnerable because it did not properly validate the destination path when it was a symlink. An attacker could cause this function to write to an arbitrary file on the filesystem that the filebrowser process has access to by creating a symlink in their directory pointing to the target file and then uploading a file to that symlink.

http.tusPatchHandler

http/tus_handlers.go

The `tusPatchHandler` function in `http/tus_handlers.go` is responsible for handling `PATCH` requests for TUS resumable uploads. This function was vulnerable to a path traversal attack using symlinks. An attacker could initiate a TUS upload to a path that is a symlink to a file outside their scope, and then use `PATCH` requests to write data to that out-of-scope file.

http.sharePostHandler

http/share.go

The `sharePostHandler` function in `http/share.go` allows users to create public links to files. It was vulnerable because it didn't prevent the creation of shares for files outside the user's designated scope if a symlink was used. An attacker could create a symlink to a sensitive file and then create a public share for it, making the sensitive file accessible to anyone with the link.

http.getFiles

http/raw.go

The `getFiles` function in `http/raw.go` is used to collect files for raw download or for creating an archive (e.g., a zip file). This function was vulnerable to a path traversal attack using symlinks. If a directory being archived contained a symlink to a directory outside the user's scope, `getFiles` would recursively follow the symlink and include the out-of-scope files in the archive, leading to information disclosure.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.