—

GO-2026-5055

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser

Details

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/filebrowser/filebrowser

Introduced in: 0

No fixed version published yet for github.com/filebrowser/filebrowser (go modules). Pin to a known-safe version or switch to an alternative.

Go / github.com/filebrowser/filebrowser/v2

Introduced in: 0 Fixed in: 2.63.14

Fix go get github.com/filebrowser/filebrowser/v2@v2.63.14

References

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-239w-m3h6-ch8v [ADVISORY]
https://github.com/filebrowser/filebrowser/commit/7c2c0a11b31b2bb214d741005a0b02b1764208b3 [FIX]
https://github.com/filebrowser/filebrowser/releases/tag/v2.63.14 [WEB]