filebrowser versions prior to 2.63.19 have a vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with Create permission to delete arbitrary files outside their allowed scope by exploiting a symlink attack during the cache TTL window.