CVE-2026-90929
Received Received - Intake

File Browser Directory Deletion via Direct-Upload

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile (a directory cannot be opened for writing) and the failure-cleanup path then calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is gated by neither the Perm.Delete permission nor the checkDescendants rule walk applied by the delete and patch handlers, so an authenticated non-administrator holding only the default Create and Modify permissions can delete directories they are not authorized to delete, including rule-denied files within them. Deletion remains confined to the user's scope because ScopedFs.RemoveAll still enforces the scope guard. The faulty cleanup was introduced in v2.5.0; no patched version is available.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90929
EUVD
EUVD-2026-77447

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser file_browser From 2.5.0 (inc) to 2.63.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90929 is an incorrect authorization flaw in File Browser versions 2.5.0 to 2.63.23. The direct-upload endpoint fails to reject existing directories as targets. When a POST request with override=true is sent to a directory, the write operation fails and triggers a cleanup that recursively deletes the directory tree using RemoveAll. This bypasses Perm.Delete permission and deny rules, allowing authenticated users with only Create and Modify permissions to delete unauthorized directories and files.

Detection Guidance

To detect this vulnerability, monitor for unexpected directory deletions or failed upload attempts to directories. Check File Browser logs for POST requests with override=true targeting directories. Use network traffic analysis tools like tcpdump or Wireshark to inspect HTTP POST requests to the /api/resources endpoint with query parameters indicating directory targets.

Impact Analysis

An attacker with authenticated access but limited permissions could delete directories and files they are not authorized to access. This includes critical system files or sensitive user data within their scope. The impact ranges from data loss to potential system compromise depending on what is deleted.

Compliance Impact

This vulnerability could lead to unauthorized data deletion, violating GDPR's integrity and availability principles or HIPAA's integrity and availability requirements. It may result in non-compliance due to unauthorized access and destruction of sensitive data, potentially leading to legal penalties or loss of certification.

Mitigation Strategies

Immediately revoke Modify permissions from upload-only accounts. Block POST requests with override=true targeting directories using reverse proxy rules (e.g., Nginx deny rules or ModSecurity). Disable the direct-upload endpoint if possible. Monitor for unusual deletion activity and restrict user permissions to the minimum required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90929. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart