FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

影響: go:github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260814233832-4126edeb07a0 → 0.0.0-20260814233832-4126edeb07a0

File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authentica…

在 GitHub Advisory Database 阅读

2026/10/28 06:04，GitHub Advisory Database 发布了“FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：Go、GitHub。CVE：CVE-2026-116682。