CVE-2026-54094: File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

File Browser enforces per-user scope with afero.NewBasePathFs(afero.NewOsFs(), scope), set up in users/users.go. This blocks lexical ../ traversal, but it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, share, or list a file. As a result, a scoped user — and in some cases an unauthenticated public-share recipient — can cross the intended scope boundary by following a symlink whose path is lexically inside their scope but whose target is outside it.

Two distinct shapes are covered here:

• Variant 1 — symlink as the final path component. A symlink that lives inside the user’s scoped tree and points to a file under the server root but outside the scope. The handlers record the symlink (IsSymlink) but then resolve and operate on the target anyway.
• Variant 2 — file or directory reached through a symlinked ancestor. A regular file requested through a symlinked directory.

Read, write (including TUS resumable uploads), share creation, and public-share serving are all affected.