NIXPKGS-2026-2110

GitHub issue published 6 days, 7 hours ago

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Permalink CVE-2026-55668

6.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): High (H)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): High (H)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

updated 6 days, 7 hours ago by @LeSuisse Activity log

Created suggestion 6 days, 13 hours ago
@LeSuisse ignored
3 packages
- filebrowser-quantum
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
6 days, 7 hours ago
@LeSuisse accepted 6 days, 7 hours ago
@LeSuisse published on GitHub 6 days, 7 hours ago

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16.

References

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8wc8-hf36-mjh9 x_refsource_CONFIRMexploit
https://github.com/filebrowser/filebrowser/commit/64511ce45e3be379e965f7f4fb0929a068d5bb81 x_refsource_MISC
https://github.com/filebrowser/filebrowser/releases/tag/v2.63.16 x_refsource_MISC

Affected products

filebrowser

==< 2.63.16

Matching in nixpkgs

pkgs.filebrowser

Web application for managing files and directories

nixos-unstable 2.63.14
- nixpkgs-unstable 2.63.14
- nixos-unstable-small 2.63.14
nixos-26.05 2.63.3
- nixos-26.05-small 2.63.3
- nixpkgs-26.05-darwin 2.63.3

Ignored packages (3)

pkgs.filebrowser-quantum

Access and manage your files from the web

nixos-unstable 1.2.2-stable
- nixpkgs-unstable 1.2.2-stable
- nixos-unstable-small 1.3.3-stable
nixos-26.05 1.2.2-stable
- nixos-26.05-small 1.3.3-stable
- nixpkgs-26.05-darwin 1.2.2-stable

pkgs.python313Packages.filebrowser-safe

Snapshot of django-filebrowser for the Mezzanine CMS

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.1
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.python314Packages.filebrowser-safe