filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows… (CVE-2026-73613)
filebrowser versions prior to 2.63.19 have a vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with Create permission to delete arbitrary files outside their allowed scope by exploiting a symlink attack during the cache TTL window.
AI Analysis
Technical Summary
CVE-2026-73613 is an out-of-scope file deletion vulnerability affecting filebrowser versions before 2.63.19. The flaw exists in the TUS upload cache eviction mechanism, where an attacker with only Create permission can replace an ancestor directory with a symlink during the cache TTL window. This causes the raw os.Remove call to delete files outside the intended ScopedFs scope, bypassing scope guards and permission checks. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).
Potential Impact
An attacker with authenticated access and Create permission can delete arbitrary files outside their permitted scope, potentially causing denial of service or data loss. The vulnerability allows bypassing of ScopedFs scope guards and permission deletion checks, leading to unauthorized file deletions. The CVSS v3.1 score is 8.2 (High), reflecting network attack vector, high impact on integrity and availability, and requiring low privileges but high attack complexity.
Mitigation Recommendations
A fix is available in filebrowser version 2.63.19. Users should upgrade to version 2.63.19 or later to remediate this vulnerability. No other mitigation or workaround is indicated in the provided data.
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows… (CVE-2026-73613)
Description
filebrowser versions prior to 2.63.19 have a vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with Create permission to delete arbitrary files outside their allowed scope by exploiting a symlink attack during the cache TTL window.
CVSS v3.1
Score 8.2high
Affected software
pkg:github/filebrowser/filebrowserRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-73613 is an out-of-scope file deletion vulnerability affecting filebrowser versions before 2.63.19. The flaw exists in the TUS upload cache eviction mechanism, where an attacker with only Create permission can replace an ancestor directory with a symlink during the cache TTL window. This causes the raw os.Remove call to delete files outside the intended ScopedFs scope, bypassing scope guards and permission checks. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access).
Potential Impact
An attacker with authenticated access and Create permission can delete arbitrary files outside their permitted scope, potentially causing denial of service or data loss. The vulnerability allows bypassing of ScopedFs scope guards and permission deletion checks, leading to unauthorized file deletions. The CVSS v3.1 score is 8.2 (High), reflecting network attack vector, high impact on integrity and availability, and requiring low privileges but high attack complexity.
Mitigation Recommendations
A fix is available in filebrowser version 2.63.19. Users should upgrade to version 2.63.19 or later to remediate this vulnerability. No other mitigation or workaround is indicated in the provided data.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-px44-p4fg-h68v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-73613"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a7e0376bf8831d5398fa0b8
Added to database: 08/13/2026, 17:48:38 UTC
Last enriched: 08/13/2026, 18:14:29 UTC
Last updated: 08/13/2026, 19:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.