{"id":"ghsa-ghsa-mgqf-5mf5-prfj","seq":1711765,"kind":"advisory","title":"FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory","url":"https://github.com/advisories/GHSA-mgqf-5mf5-prfj","permalink":"https://vulnpulse.app/items/ghsa-ghsa-mgqf-5mf5-prfj","summary":"影響: go:github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260814233832-4126edeb07a0 → 0.0.0-20260814233832-4126edeb07a0\nFile read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authentica…","severity":"high","techs":["go","github"],"cves":["CVE-2026-116682"],"tags":["GHSA-mgqf-5mf5-prfj","github.com/gtsteffaniak/filebrowser/backend"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-27T21:04:40.000Z","fetched_at":"2026-10-27T21:17:52.472Z"}