Description
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules. Attackers can read and overwrite rule-denied files by accessing them through in-scope symbolic link aliases that resolve to denied paths.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| filebrowser | filebrowser | ≤ 2.63.23 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | filebrowser +1 | No fix yet | — |
References
- GitHub Security Advisory (GHSA-7w29-q235-57m9) vendor-advisory
- VulnCheck Advisory: File Browser through 2.63.23 Path Traversal via Symlink Alias third-party-advisory