File Browser CVE-2026-72837

Exploitation requires two specific conditions: first, the File Browser instance must be configured to use proxy authentication (header-based reverse-proxy auth) or hook authentication (external command/script-based auth) as the authentication method - instances using built-in username/password authentication are NOT affected. Second, the attacker must possess valid credentials accepted by the upstream identity provider, granting them a legitimate authenticated session. No additional privileges, special roles, or non-default settings beyond these two preconditions are required. What limits exploitation is the credential gate: an unauthenticated external attacker cannot bypass the upstream identity provider. The vulnerability is scoped to the auto-provisioning flow, so users already provisioned with correct directory scopes via non-affected paths may not be re-provisioned with root scope on subsequent logins - the risk is highest on initial user creation through these paths.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7 and accurately characterizes this as a high-severity, low-complexity, network-exploitable flaw requiring only low privileges. The PR:L designation is critical: exploitation is gated on possessing valid upstream-authenticated credentials, which meaningfully limits the attacker population to users who have already authenticated through the upstream identity provider. However, in deployments where proxy or hook auth is used for SSO across a user base, any one of those users can immediately pivot to full file access for all others - the attack requires no additional tooling or privilege escalation beyond a valid login. No EPSS data was provided in the input, and the vulnerability is not listed in CISA KEV, suggesting no confirmed widespread active exploitation. The absence of KEV does not indicate low real-world risk in shared or multi-tenant File Browser deployments, where the blast radius is the entire user file corpus. The scope is unchanged (SC:N/SI:N/SA:N), meaning the compromise stays within the File Browser application boundary and does not pivot to the underlying OS or adjacent systems.

An attacker with a valid account in the upstream identity provider (e.g., an LDAP, SAML, or OAuth-backed SSO system fronting File Browser via a reverse proxy) logs in normally through the proxy authentication flow. Because their session is provisioned with server root scope rather than a sandboxed directory, they can immediately navigate to and exfiltrate, overwrite, or delete files belonging to other users - including administrators - without any additional exploitation steps. No public exploit code has been identified at time of analysis, but the straightforward nature of the scope bypass means any technically capable authenticated user could replicate the behavior manually.