FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

影響: go:github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260814233832-4126edeb07a0 → 0.0.0-20260814233832-4126edeb07a0

File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authentica…

GitHub Advisory Database에서 읽기

2026. 10. 28. 오전 06:04, GitHub Advisory Database에서 "FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Go, GitHub. CVE: CVE-2026-116682.