Filebrowser CVE-2026-35605

The CVSS v4.0 score of 6.3 reflects low-to-moderate severity with a network attack vector, high attack complexity, and low integrity impact (VI:L). The CVSS v4.0 scoring model indicates this is not trivial to exploit (AC:H suggests specific conditions must be met, likely requiring knowledge of the exact directory structure and rule configuration), but the attack requires no privileges or user interaction. The vulnerability is a real priority in environments where File Browser is used to enforce access isolation between user directories or sensitive data repositories. The integrity impact is classified as low rather than high because the vulnerability permits unauthorized file modification or deletion only within the scope of incorrectly-matched directories; it does not grant arbitrary code execution or complete system compromise. However, in multi-tenant or shared-storage scenarios, this could escalate to data theft or deletion if an attacker can identify overlapping directory naming patterns. The lack of confirmed active exploitation or public POC code suggests this is not yet a widespread threat, but organizations running File Browser should prioritize patching given the ease of exploitation once the vulnerability pattern is understood.

A File Browser administrator configures an access rule to restrict a sensitive directory: 'deny /sensitive_data'. Due to the vulnerability, a second directory named /sensitive_data_archive/ is also inadvertently denied access. Alternatively, if the rule was intended to grant access only to /uploads/, an attacker aware of the flaw could request files from /uploads_backup/ and receive the same access level. The attack requires only network-level HTTP requests to the File Browser web interface and knowledge of the directory structure-no authentication credentials or credentials are needed. An attacker would enumerate directory names through error messages or educated guessing (common naming patterns like _backup, _old, _test) and attempt to access them, discovering and exploiting the prefix-matching flaw.