{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"github.com/filebrowser/filebrowser","cve_ids":["CVE-2026-55667"],"ecosystem":"Go","epss":0.00494,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-fmm7-x4gx-8jhr","id":"tcs_01M5KGRBC1KZWB2RZQ68DZSS55","modified_at":"2026-07-22T21:00:24.289388395Z","published_at":"2026-07-22T20:36:35Z","references":["https://osv.dev/vulnerability/GO-2026-6021","https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fmm7-x4gx-8jhr","https://nvd.nist.gov/vuln/detail/CVE-2026-55667","https://github.com/filebrowser/filebrowser/blob/be23ab3a15bf957928ecfed88de5ab67850c1b9c/http/resource.go#L172-L174"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6021","url":"https://osv.dev/vulnerability/GO-2026-6021"}],"summary":"File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser"}