## FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

- 種別: advisory
- 重大度: high
- 関連技術: go, github
- CVE: CVE-2026-116682
- 公開日時: 2026-10-27T21:04:40.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-mgqf-5mf5-prfj)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-mgqf-5mf5-prfj

影響: go:github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260814233832-4126edeb07a0 → 0.0.0-20260814233832-4126edeb07a0
File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authentica…