FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

影響: go:github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260814233832-4126edeb07a0 → 0.0.0-20260814233832-4126edeb07a0

File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authentica…

GitHub Advisory Databaseで読む

2026/10/28 06:04、GitHub Advisory Databaseが「FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: Go、GitHub。CVE: CVE-2026-116682。