Link following in FileBrowser - #VU133483

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose sensitive information and overwrite files outside the intended filebrowser scope.

The vulnerability exists due to improper link resolution before file access in the HTTP file handlers when processing paths that reference symbolic links inside a scoped directory. A remote attacker can access a symlink that points outside the scoped directory to disclose sensitive information and overwrite files outside the intended filebrowser scope.

If public sharing is permitted, the issue can also expose the outside target through a public share. The proof assumes a symlink already exists inside the user's scoped directory, or that another allowed workflow can place it there.

Remediation

Sources

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-239w-m3h6-ch8v