GHSA-8wc8-hf36-mjh9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

• Go github.com/filebrowser/filebrowser/v2: < 2.63.16 → fixed in 2.63.16

Summary `ScopedFs` confines every File Browser user to a scope directory. Its `within()` guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a dangling symlink (target does not exist), the nearest existing ancestor is the in-scope directory containing the link, so the guard returns "in scope" and the subsequent `os.OpenFile(O_CREATE)` follows the link and creates the file at its out-of-scope target. A post-auth user with `Create` and `Modify` permission can write attacker-controlled content to any non-existent path outside their scope that the File Browser process can write to. The precondition is a dangling symlink present inside the user's scope, which is the same out-of-band precondition the rest of `ScopedFs` is built to defend against. This is a patch-gap variant of the GHSA-239w-m3h6-ch8v symlink confinement issue, not a resubmission of the already-published vulnerable-version behavior: GHSA-239w-m3h6-ch8v marks ` /tmp/root/outside/created-by-http.txt /tmp/root/outside/ # exists /tmp/root/outside/created-by-http.txt # does not exist yet ``` `EvalSymlinks(/tmp/root/scope/escape)` returns not-exist, and the fallback validates `/tmp/root/scope`. The final `OpenFile` still follows `/tmp/root/scope/escape` and creates `/tmp/root/outside/created-by-http.txt`. Reachability over HTTP Endpoint: `POST /api/resources/?override=true` (also `PUT`, and `POST/PATCH /api/tus/...`). Verified trace against the audited source: 1. `http/resource.go` `resourcePostHandler` requires `d.user.Perm.Create` (else 403). 2. `files.NewFileInfo` is called. For a dangling symlink, `stat()` in `files/file.go` does `LstatIfPossible` (sees the symlink, `err == nil`, `IsSymlink = true`), then `Fs.Stat` follows the link and fails with ENOENT, so the code returns the symlink `FileInfo` with `err == nil`. The handler therefore enters the "file exists" branch. 3. The branch requires `override == "true"` and `d.user.Perm.Modify`, then proceeds. 4. `writeFile(d.user.Fs, r.URL.Path, r.Body, ...)` calls `afs.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fileMode)`. 5. `ScopedFs.OpenFile` runs `guard()`, which passes for the dangling link, then `os.OpenFile` follows the link and creates the file outside the scope with the request body as content. The TUS path (`http/tus_handlers.go` `tusPostHandler` -> `OpenFile`, then `tusPatchHandler`) reaches the same sink. Why existing defenses do not apply • `afero.BasePathFs` lexical confinement only neutralizes `..`. A plain link name passes it unchanged. • `ScopedFs.within()` is the dedicated symlink defense, and it is the component that fails: the not-exist walk-up validates the link's parent directory instead of the link. • The project's symlink tests (`http/tus_symlink_test.go` `TestTusHandlersRejectSymlinkScopeEscape`, `files/file_test.go`) only exercise escaping symlinks whose target exists. Those are blocked. The dangling variant is never tested, so the regression suite does not catch it. Proof of concept The PoC drives the real security boundary, `files.NewScopedFs`, with the same flags `http.writeFile` uses, and shows the write landing outside the scope. A control test shows the existing-target case is still blocked, proving the guard is real and the gap is specifically the dangling case. ```go const writeFlags = os.O_RDWR | os.O_CREATE | os.O_TRUNC // == http.writeFile scope := filepath.Join(root, "user") // the low-priv user's jail outside := filepath.Join(root, "outside") // sibling dir = another tenant / host path // Precondition: a dangling escaping symlink inside the scope. os.Symlink(filepath.Join(outside, "pwned.txt"), filepath.Join(scope, "evil")) // target does not exist yet fs := files.NewScopedFs(afero.NewOsFs(), scope) f, _ := fs.OpenFile("/evil", writeFlags, 0o644) // not rejected f.WriteString("OWNED-OUTSIDE-SCOPE") // assert: outside/pwned.txt must NOT exist ``` Observed result: ```text === RUN TestDanglingSymlinkWriteEscapesScope poc_test.go:49: VULNERABLE: write escaped the scope and created /tmp/.../001/outside/pwned.txt with content "OWNED-OUTSIDE-SCOPE" --- FAIL: TestDanglingSymlinkWriteEscapesScope (0.00s) === RUN TestExistingTargetSymlinkIsBlocked poc_test.go:78: guard correctly blocked existing-target escape: permission denied --- PASS: TestExistingTargetSymlinkIsBlocked (0.00s) ``` The dangling test "fails" by design: the assertion fires because the file escaped. The control test passes: an `escape_link -> outside` (existing dir) write to `escape_link/injected.txt` is rejected by `OpenFile` with `permission denied` and nothing is created in `outside/`. That is exactly the scenario the project's own tests cover. End-to-end HTTP equivalent: ```text POST /api/resources/escape?override=true X-Auth: body: http-outside -> ScopedFs.OpenFile("/escape", O_CREATE|O_TRUNC) follows the dangling link -> file created at the link's out-of-scope target with the request body ``` The handler returns `200 OK`, and the outside file contains the uploaded body. Impact • **Direct primi…