CVE-2026-54094 File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope
Attackers can bypass scope restrictions via symbolic links to read, overwrite, or share files outside their permitted directory in File Browser.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54094?
CVE-2026-54094 is a high-severity path traversal vulnerability in filebrowser, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it. This vulnerability is fixed in 2.63.14.
Which versions are affected by CVE-2026-54094?
6 open source packages ship an affected version, including github.com/filebrowser/filebrowser and github.com/filebrowser/filebrowser/v2.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser Go | All versions | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser Go | All versions to 1.11.0 | None |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.14 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.14 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.14 |
How do I fix CVE-2026-54094?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54094 exists.
Sources
Also known as GHSA-239w-m3h6-ch8v, GO-2026-5055.