Loading vulnerability…
Arbitrary File Deletion in filebrowser TUS Cache Eviction
CVE-2026-73613 is an improper link resolution vulnerability in filebrowser affecting versions before 2.63.19. The flaw exists in the TUS upload cache eviction mechanism, where a raw file deletion operation can be redirected outside the intended filesystem scope. An authenticated user with only Create permission can exploit a time-of-check/time-of-use style race during the cache TTL window by replacing an ancestor directory with a symbolic link, causing the eviction path to resolve to an unintended target. This bypasses ScopedFs scope enforcement and Perm.Delete authorization checks, enabling deletion of files outside the attacker's authorized scope.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privilege user to delete arbitrary files outside their assigned scope. The primary impact is unauthorized integrity destruction and potential availability loss, since targeted files can be removed even when the attacker lacks delete permission for those resources. Depending on what files are deleted, this could disrupt application operation or damage data stored on the host filesystem.
If you can’t patch tonight, do this now.
If immediate patching is not possible, reduce exposure by restricting untrusted users' ability to perform TUS uploads or otherwise create conditions that trigger cache eviction, and limit accounts that have Create permission. Additional hardening should prevent attacker-controlled symlink manipulation within reachable filesystem paths and constrain the application's filesystem access so that deletion outside the intended scope cannot affect sensitive host files.
Patch, then assume compromise.
Upgrade filebrowser to version 2.63.19 or later, which is listed as unaffected. Apply the vendor's security patch across all deployments running earlier versions.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.