PT-2026-49067 · Unknown · Filebrowser

Alanturing881

+2

·

CVE-2026-54094

·

Published

2026-06-12

·

Updated

2026-06-25

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions File Browser (affected versions not specified)
Description File Browser fails to properly validate symbolic links, allowing scoped users or unauthenticated public-share recipients to access files outside their intended directory boundaries. While the software prevents lexical ../ traversal, it does not stop handlers from following symlinks that point to locations outside the user's scope. This occurs in two ways: when a symlink is the final path component, or when a file is accessed through a symlinked ancestor directory.
This issue affects reading, writing (including TUS resumable uploads), share creation, and public-share serving. An attacker can use these flaws to read out-of-scope file contents, overwrite files, or create public shares for restricted data.
Technical details include vulnerabilities in the following endpoints and functions:
  • API Endpoints: GET /api/raw/{path}, GET /api/resources/{path}, POST /api/resources/{path}, POST /api/tus/{path}, PATCH /api/tus/{path}, POST /api/share/{path}, and GET /api/public/dl/{hash}.
  • Vulnerable Parameters: path and override.
  • Vulnerable Functions: stat(), readListing(), getFiles(), writeFile(), tusPostHandler(), and tusPatchHandler().
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Link Following

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-59CWE-22

Related Identifiers

CVE-2026-54094
GHSA-239W-M3H6-CH8V
GO-2026-5055

Affected Products

Filebrowser