Vulnerability GO-2026-6021
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
3 months ago
July 22, 2026 at 08:36 PM UTC
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser
*
*
Summary
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser
Details
File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Low Risk
2 hours ago
File Browser: Trailing-slash directory deletion leaves public shares active for recreated paths
<2.63.17 GHSA-pp88-jhwj-5qh5
<2.63.17 GHSA-pp88-jhwj-5qh5
Unknown
3 months ago
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope in github.com/filebrowser/filebrowser
* GO-2026-6020
* GO-2026-6020
Unknown
3 months ago
File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope in github.com/filebrowser/filebrowser
<2.63.16 GO-2026-6020
<2.63.16 GO-2026-6020
Unknown
3 months ago
File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser
* GO-2026-6024
* GO-2026-6024
Unknown
3 months ago
File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser
<2.63.17 GO-2026-6024
<2.63.17 GO-2026-6024
Impacted packages
Timeline
Published
3 months ago
July 22, 2026 at 08:36 PM UTC
Fixed (v2.63.16)
4 months ago
June 23, 2026 at 11:33 AM UTC
Last Modified
3 months ago
July 22, 2026 at 09:00 PM UTC