File and Path Handling

Every one of the 9 is a mark on the map. Named now: 1 to 9, most at risk first.

1. filebrowser before 2.63.19 Out-of-Scope File Deletion via SymlinkCVE-2026-73613filebrowser · CVSS 8.2 · 0.6% likely

   CWE-59

2. File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scopeCVE-2026-54094filebrowser · CVSS 7.5 · 0.5% likely

   CWE-22

3. File Browser through 2.63.23 Path Traversal via Symlink AliasCVE-2026-90930filebrowser · CVSS 6.8 · 0.5% likely

   CWE-59

4. filebrowser before v2.63.21 Access Rule Bypass via Path CanonicalizationCVE-2026-72835filebrowser · CVSS 6.8 · 0.5% likely

   CWE-41

5. File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanupCVE-2026-55667filebrowser · CVSS 8.2 · 0.5% likely

   CWE-22

6. File Browser has an access rule bypass via HasPrefix without trailing separator in path matchingCVE-2026-35605filebrowser · CVSS 7.5 · 0.4% likely

   CWE-22

7. File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)CVE-2026-62843filebrowser · CVSS 6.8 · 0.4% likely

   CWE-23

8. File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeCVE-2026-55668filebrowser · CVSS 6.3 · 0.4% likely

   CWE-22

9. File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenamesCVE-2026-54093filebrowser · CVSS 6.8 · 0.2% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.