---
id: CVE-2026-90929
title: >-
  File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect
  authorization flaw in the direct-upload endpoint (resourcePostHandler in
  http/resource.go)
summary: >-
  File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect
  authorization flaw in the direct-upload endpoint (resourcePostHandler in
  http/resource.go). Unlike the TUS upload handler, the direct-upload handler
  does not reject a tar…
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'
cwe:
  - CWE-863
vendor: filebrowser
product: filebrowser
affected:
  - filebrowser >= 2.5.0 <= 2.63.23
published: '2026-09-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:44:42.207'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90929'
references:
  - url: >-
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-c4fr-5f24-4wrj
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/file-browser-2.5.0-directory-deletion-via-upload-failure-cleanup
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00436
epssPercentile: 0.35242
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-14T17:32:43.771832Z'
ingestedAt: '2026-09-14T15:23:07.430Z'
---

## Overview

File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing directory; a POST with ?override=true aimed at a directory fails inside writeFile (a directory cannot be opened for writing) and the failure-cleanup path then calls Fs.RemoveAll on the request path, recursively deleting the entire tree. This cleanup is gated by neither the Perm.Delete permission nor the checkDescendants rule walk applied by the delete and patch handlers, so an authenticated non-administrator holding only the default Create and Modify permissions can delete directories they are not authorized to delete, including rule-denied files within them. Deletion remains confined to the user's scope because ScopedFs.RemoveAll still enforces the scope guard. The faulty cleanup was introduced in v2.5.0; no patched version is available.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.