Vulnerability · CVE-2026-116682
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
Published Oct 27, 2026 · catalog updated Oct 27, 2026 · FileBrowser: Symlink following escapes
Last checked Nov 6, 2026. A connected source was read within the last 7 days.
Check if you run it
No confirmed exploitation is on record for CVE-2026-116682. EPSS is 0.54%. Act only if a listed version of FileBrowser: Symlink following escapes is installed.
Gaps on this record
- The stored product name is a package slug. The name on this page is taken from the title (FileBrowser: Symlink following escapes).
- No vendor fix or required action is stored. Compare the linked advisory before you change production.
- Severity
- High8.6
- Known exploitation
- Not in CISA/VulnCheck KEV
- EPSS
- 0.54%
- Remediation
- Version ranges on file
- Affected products
- Go github.com/gtsteffaniak/filebrowser/backend · go github.com/gtsteffaniak/filebrowser/backend · golang github.com
## Summary File read paths resolve symbolic links with and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to , another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through the normal download, preview, media, and OnlyOffice endpoints. Any authenticated user with download access can read files anywhere the server process can, whenever such a symlink is reachable in their scope. The same symlink-following read path is used by the public share endpoints, which are authorized only by a share hash and not by any account, so when a public share exposes a directory that contains such a symlink, an unauthenticated attacker holding only the share link reads files outside the scope with no credential. ## Details **1. Symlink resolution performs no containment check ( )** There is no comparison of against the index/scope root. **2. returns the resolved target unchecked ( )** is then used by file handlers to open and serve the file. No caller re-validates that is a descendant of the user's source root. (By contrast, the project did add containment for archive extraction via , but that guard is specific to extraction and is not applied to this general read path.) **3. The read handlers request symlink following, including the unauthenticated public-share handlers ( , , , )** Authenticated download, preview, media-subtitle, and OnlyOffice read flows all set , and so do the public share handlers in . The public download route is registered as ( ), where authorizes by the share hash alone with no account, so the same escape is reachable with no authentication when a public share exposes a directory containing the symlink. ## PoC Confirmed live on . A symlink pointing outside the user's directory must exist inside it; here it is placed on the host volume, whi
Are you affected?
Enter the version you run. The result uses only the ranges stored on this record.
The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.
- Go github.com/gtsteffaniak/filebrowser/backend0 → 0.0.0-20260814233832-4126edeb07a0
- go github.com/gtsteffaniak/filebrowser/backend< 0.0.0-20260814233832-4126edeb07a0
- golang github.comversion unspecified
How to fix CVE-2026-116682
Upgrade
CVE-2026-116682 lists a fix boundary at 0.0.0-20260814233832-4126edeb07a0. Compare the installed build with that boundary before you change production.
Version check
Affected < 0.0.0-20260814233832-4126edeb07a0
Advisory
Open the cve_org record and follow its fix.
Official advisories
What to do
Three questions, each answered from this record only. Confirm the vendor advisory before you patch.
Should you patch?
No confirmed exploitation is on record for CVE-2026-116682. EPSS is 0.54%. Act only if a listed version of FileBrowser: Symlink following escapes is installed.
Which versions are affected?
Compare what you have installed with 0 → 0.0.0-20260814233832-4126edeb07a0, < 0.0.0-20260814233832-4126edeb07a0. Compare the installed version with the linked vendor advisory before you change production.
What should an analyst verify?
CWE-22: Path Traversal; CWE-59: Link Following. EPSS 0.54%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 27, 2026 · GitHub Advisory Database
Detected
## Summary File read paths resolve symbolic links with and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to , another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through
Oct 27, 2026 · GitHub Advisory Database
Fix available
github.com/gtsteffaniak/filebrowser/backend fixed in 0.0.0-20260814233832-4126edeb07a0
Oct 27, 2026 · GitHub Advisory Database
Fix available
github.com/gtsteffaniak/filebrowser/backend fixed in 0.0.0-20260814233832-4126edeb07a0
Oct 27, 2026 · GitHub Advisory Database
Updated
## Summary File read paths resolve symbolic links with and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to , another tenant's directory, SSH keys, or container secrets) is followed transparently, and its contents are served through
Sources
- CVE.orgVulnerability recordCVE-2026-116682
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-116682
30-day exploitation probability 0.54%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-mgqf-5mf5-prfj
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-116682
File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope (for example to /etc/passwd, another tenant's directory, SSH keys, or container secrets) is followed transparently, and its conten
advisories.gitlab.com - Go Vulnerability DatabasePackage advisoryGHSA-mgqf-5mf5-prfj
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
osv.dev - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-mgqf-5mf5-prfj
FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory
osv.dev
References
Freshness
Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.
- FIRST EPSSNov 6, 2026
- Go Vulnerability DatabaseOct 28, 2026
- GitHub Advisory DatabaseOct 28, 2026
- OpenSSF OSV / OSV ScannerOct 28, 2026
- CVE.orgOct 28, 2026
- GitLab Advisory DatabaseOct 28, 2026