filebrowser CVE-2026-72835

Exploitation requires three concurrent conditions: (1) the attacker must hold a valid filebrowser account (PR:L - unauthenticated access is not possible); (2) the administrator must have configured at least one deny rule for a path the attacker wishes to reach - deployments without deny rules are not affected; and (3) the server must run on a case-insensitive filesystem (e.g., Windows NTFS or macOS HFS+ in default mode) for the case-variant technique, or filebrowser must be running on Windows for the backslash-separator technique. Deployments on Linux with ext4 or other case-sensitive filesystems are not vulnerable to the case-variant path technique, though backslash handling may still apply depending on build configuration. These prerequisites materially limit the realistic attack surface: many self-hosted Linux deployments with case-sensitive filesystems are unaffected by the most common exploit path.

The CVSS 4.0 score of 7.6 reflects a meaningful but conditionally constrained risk. The vector AV:N/AC:H/AT:P/PR:L/UI:N confirms the attack is network-reachable with low privileges but requires specific preconditions (AT:P): the target deployment must use either a case-insensitive filesystem or an OS that interprets backslash as a path separator (notably Windows), and the administrator must have configured deny rules - without deny rules, there is nothing to bypass. The VC:H/VI:H impact metrics indicate both read and write access to otherwise-denied files, which elevates real-world severity considerably. The exploit is conceptually trivial (no memory corruption, no heap spraying) but depends on deployment environment, making it high-impact in vulnerable contexts and irrelevant in others. No CISA KEV listing and no confirmed POC lower the urgency slightly, though the technique is well-documented in web security literature. EPSS data was not provided; the conditional prerequisites suggest exploitation will be targeted rather than widespread.

An authenticated low-privilege filebrowser user targets a directory the administrator has added to a deny list, such as '/admin-only/payroll/'. The user requests '/Admin-Only/Payroll/' (case-variant) or '/admin-only\payroll/' (backslash separator) through the filebrowser API. The access rule engine compares the submitted string against deny rules, finds no match, and permits the I/O - the OS filesystem then resolves the path to the same restricted directory and returns the file contents. No special tooling is required beyond a standard HTTP client.