CVE-2026-90930
Received Received - Intake

File Browser Path Traversal via Symbolic Link Bypass

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90930
EUVD
EUVD-2026-77448

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
file_browser file_browser to 2.63.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects File Browser versions up to 2.63.23. It involves improper handling of symbolic links where access rules are applied to the requested path but not reapplied after resolving the link to its target. This allows authenticated users to bypass deny rules by accessing restricted files through allowed symbolic link aliases that point to denied paths.

Detection Guidance

Check for symbolic links within user-accessible directories that point to restricted paths. Use commands like 'find /path/to/scope -type l -ls' to list symlinks and 'readlink -f /path/to/symlink' to resolve targets. Verify if deny rules are bypassed by accessing files through these symlinks.

Impact Analysis

Authenticated users can read or overwrite files that should be restricted by path deny rules. Attackers exploit this by using symbolic links within their allowed scope that point to denied files. The vulnerability defeats intended confidentiality and integrity protections of path rules.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating compliance requirements for data protection such as GDPR (confidentiality) and HIPAA (integrity and confidentiality). It undermines access control mechanisms designed to meet regulatory standards.

Mitigation Strategies

Audit user scopes for symlinks pointing to denied paths. Remove or repoint such symlinks to prevent bypassing deny rules. Since no patches exist, restrict symlink creation in sensitive directories and monitor for unauthorized access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90930. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart