FileBrowser contains a vulnerability where symbolic links (symlinks) inside a user's accessible directory can point outside the intended scope, allowing arbitrary file reads outside the served directory. This occurs because the application resolves symlinks without verifying that the resolved target remains within the user's authorized directory. Both authenticated users with download access and unauthenticated users accessing public shares can exploit this to read arbitrary files accessible to the server process. The issue affects version prior to 0.0.0-20260814233832-4126edeb07a0 and is fixed in that version.