FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

影響: go:github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260814233832-4126edeb07a0 → 0.0.0-20260814233832-4126edeb07a0

File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authentica…

Read on GitHub Advisory Database

On 10/28/2026, 06:04 AM, GitHub Advisory Database published "FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory" (type: Advisory). Severity is "High" (high). Related technologies: Go, GitHub. CVE: CVE-2026-116682.