Filebrowser CVE-2026-35607

File Browser versions prior to 2.63.1 with proxy authentication enabled. Attacker exploits auto-created user accounts via first successful proxy-auth login to gain execution capabilities. Requires proxy auth handler configured; signup handler alone is not vulnerable.

This vulnerability presents moderate-to-high real-world risk despite the CVSS 8.1 rating, contingent on deployment architecture. The CVSS vector indicates network-accessible attack (AV:N) requiring no authentication (PR:N) but high complexity (AC:H). The high complexity reflects that exploitation requires a deployment using proxy authentication rather than standard signup, narrowing the vulnerable population. The conflicting PR:N designation appears inconsistent with proxy-auth context where external authentication occurs; this likely reflects the perspective that once proxy-auth headers are present, File Browser itself performs no additional authentication check. EPSS data not provided but the specific deployment requirement (proxy-auth enabled) and lack of public exploit reduce immediate mass-exploitation risk. However, for organizations using proxy authentication with File Browser, the technical impact is severe: attackers who successfully authenticate through the proxy gain unauthorized command execution (C:H/I:H/A:H). No CISA KEV listing indicates no confirmed active exploitation. SSVC assessment: exploitation status is POC (theoretical given GitHub advisory), automatable once proxy-auth is bypassed, technical impact is total with command execution capability. Priority depends heavily on whether proxy authentication is enabled in your deployment.

An attacker identifies a File Browser instance using proxy authentication with a permissive upstream authentication system or compromised proxy credentials. After successfully authenticating through the proxy layer (potentially via credential stuffing, session hijacking, or exploiting weaknesses in the proxy's authentication logic), the attacker's first login triggers automatic account creation in File Browser. Due to the vulnerability, this auto-created account inherits full execution permissions from global defaults. The attacker then leverages File Browser's command execution features to run arbitrary shell commands on the hosting server, potentially establishing persistence, exfiltrating sensitive files, or pivoting to other internal systems. The high attack complexity (AC:H) reflects that successful exploitation requires both proxy-auth configuration and the ability to authenticate through the external proxy mechanism.