Symlink Race Condition Enables Unauthorized File Deletion

CVE-2026-73613 affects filebrowser versions before 2.63.19 and exploits a critical flaw in the TUS upload cache eviction mechanism. The vulnerability allows authenticated users with minimal Create permissions to delete arbitrary files far outside their intended scope by leveraging a race condition window. An attacker can swap an ancestor directory with a symbolic link during the cache TTL (time-to-live) period, causing the raw os.Remove call to follow the symlink and delete out-of-scope targets. This bypasses both the ScopedFs scope guards and explicit Perm.Delete permission checks, making it a privilege escalation vulnerability that turns limited file upload capabilities into full system file deletion access. Organizations running filebrowser in multi-tenant or restricted-access scenarios face significant risk of data loss and system compromise.

While this CVE is not yet mapped to specific MITRE ATT&CK techniques in public databases, Casky's extended reasoning capabilities would detect the attack patterns underlying this vulnerability by analyzing: (1) CWE-59 (Improper Link Resolution Before File Access) behaviors that indicate symlink manipulation attempts; (2) anomalous file system calls where Create permissions suddenly result in Delete operations; (3) temporal patterns showing rapid directory structure changes during cache operations; and (4) privilege escalation signals where low-privileged authenticated sessions access protected file paths. Practitioners would observe findings highlighting suspicious os.Remove calls targeting out-of-scope directories, permission enforcement bypasses, and race condition windows in cache TTL handling—enabling detection of exploitation attempts before data is deleted.