Authorization Flaw in File Browser Affects User Directory Permissions

CVE-2026-90929

What is CVE-2026-90929?

File Browser versions ranging from 2.5.0 to 2.63.23 have a significant authorization flaw in their direct-upload endpoint, specifically within the resourcePostHandler. This vulnerability allows an authenticated user with only Create and Modify permissions to execute unauthorized deletions of directories. Unlike the secured TUS upload handler, the flawed direct-upload handler neglects to reject uploads targeting existing directories, which leads to a recursive deletion of directories via an incorrect cleanup process. The issue, introduced in version 2.5.0, permits deletion of files and directories that the user usually cannot access, compromising directory integrity and data security.

References