CVE-2026-116682 gtsteffaniak CVE debrief

Who should care

Administrators and users of FileBrowser, especially those who expose it to the internet or untrusted networks, should assess their exposure and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-116682 allows unauthenticated and authenticated users to read files outside the served directory via symlink following, potentially leading to sensitive information disclosure.

• Unauthenticated attackers can read sensitive files outside the served directory
• Authenticated users with download access can read files anywhere the server process can
• Symlink following allows access to sensitive files such as `/etc/passwd`, SSH keys, or container secrets

Technical summary

The vulnerability exists in the FileBrowser application, specifically in the symlink resolution process which fails to perform a containment check after resolving symlinks. This allows an attacker to read files outside the served directory, including sensitive files such as `/etc/passwd`, SSH keys, or container secrets. The `filepath.EvalSymlinks` function is used to resolve symlinks without properly checking if the resolved path is still within the user's scope. To exploit this vulnerability, an attacker can create a symlink in a user's accessible directory that points to a sensitive file outside the scope. The same symlink-following read path is used by the public share endpoints, which are authorized only by

Defensive priority

High

Recommended defensive actions

• Review and update FileBrowser to ensure symlink resolution properly checks the resolved path
• Restrict access to sensitive files and directories
• Monitor for suspicious activity and implement additional logging and monitoring
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the `filepath.EvalSymlinks` function being used to resolve symlinks without properly checking if the resolved path is still within the user's scope. This allows an attacker to read files outside the served directory, including sensitive files such as `/etc/passwd`, SSH keys, or container secrets.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.