Dissecting CVE-2026-73613: File Deletion via Symlink in TUS
For this blog, we’ll look at CVE-2026-73613: Out-of-scope file deletion via symlink-following delete in TUS upload-cache eviction and trace it back to the source code to understand exactly where the vulnerable behavior comes from and how it can lead to file deletion outside the intended directory. We have 3 keywords in the title: Out-of-scope file deletion symlink TUS upload-cache eviction 1. Out-of-scope file deletion This one is pretty simple. Consider the following scenario: ...