CVE-2026-90930CWE-59

CVE-2026-90930

Medium · published September 14, 2026

CVSS v3.1
6.8
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
7.6 · CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00500 · 42.0th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-09-14T17:19Z
References (3)
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9 · [email protected]https://www.vulncheck.com/advisories/file-browser-through-2.63.23-path-traversal-via-symlink-alias · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7w29-q235-57m9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 14 SEP 12:48Z
    File Browser through 2.63.23 Path Traversal via Symlink Alias
    cvelistv5