CVE-2026-73613 in Filebrowser
Summary
by MITRE • 08/13/2026
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an ancestor directory with a symlink during the cache TTL window to redirect the raw os.Remove call to an out-of-scope target, bypassing ScopedFs scope guards and Perm.Delete checks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability in Filebrowser versions prior to 2.63.19 represents a critical security flaw within the TUS upload cache eviction mechanism that fundamentally undermines the application's file system access controls. This issue affects the scoped file system implementation where users should be restricted to operations within their designated directories, yet an authenticated user with only create permissions can execute destructive actions beyond their intended scope. The vulnerability stems from improper handling of the cache eviction process during temporary upload storage management.
The technical implementation flaw occurs when the system processes TUS (resumable uploads) and manages temporary files in a cache directory. During this process, the application employs an os.Remove call to clean up expired cache entries without sufficient validation of the target file paths. The vulnerability specifically manifests during the Time To Live (TTL) window when cache cleanup operations occur, creating a temporal window where symbolic link manipulation can be exploited. Attackers exploit this by creating a symbolic link that points to a directory outside their scope within the TTL window, effectively redirecting the legitimate file deletion operation to target files they should not have access to.
This vulnerability directly maps to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and CWE-73 (Restriction of Paths) within the Common Weakness Enumeration framework, demonstrating how inadequate path validation can lead to privilege escalation through directory traversal attacks. The attack vector leverages the temporal nature of cache management systems where the scope guards are bypassed during specific operations that should otherwise be protected by the ScopedFs implementation. The Perm.Delete checks that normally protect against unauthorized file deletion are effectively circumvented because the malicious operation occurs within a legitimate system process rather than direct user interaction.
The operational impact of this vulnerability is severe as it allows authenticated users to delete arbitrary files on the server, potentially leading to data loss, service disruption, and system compromise. An attacker with only create permissions can leverage this flaw to remove critical system files, user data, or application components, effectively escalating their privileges beyond what was intended by the access control model. The vulnerability is particularly dangerous in multi-user environments where users may have minimal required permissions but could use this exploit to gain broader destructive capabilities.
Mitigation strategies should focus on implementing strict path validation within the cache eviction mechanism, ensuring that all file operations during cleanup strictly validate target paths against the user's scope boundaries. The system must enforce immutable checks that prevent symbolic link resolution during critical operations and implement proper sandboxing of cache directories to prevent external path traversal. Additionally, the TTL window should be minimized or eliminated through better cache management strategies that avoid relying on time-based cleanup mechanisms for potentially destructive operations. Updates to Filebrowser version 2.63.19 and later incorporate these protections, implementing enhanced scope validation and eliminating the vulnerable code paths that allowed this out-of-scope deletion attack to succeed.