File Browser EUVD-2026-39508

Requires the target to be configured with proxy authentication (auth.method=proxy) AND for the File Browser server to be directly reachable on the network by the attacker, bypassing the trusted reverse proxy that normally sets the identity header. Given those conditions, exploitation is remote and fully unauthenticated (PR:N) with no user interaction (UI:N) - the attacker simply sets the proxy identity header to a chosen username. Limiting factors: this is a non-default deployment mode, so instances using password/JSON auth or instances strictly fronted by a proxy that overwrites the header are not exploitable; the proxy header name must match the server's configured header.

Signals are largely consistent on the high-severity end: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N describes trivial network exploitation with no privileges or user interaction, yielding full confidentiality and integrity loss, which fits a single-header admin impersonation. The critical caveat the raw 9.1 does not capture is that exploitation is gated on a specific, non-default deployment: auth.method=proxy AND the File Browser instance being directly reachable rather than strictly fronted by the proxy. Correctly deployed instances (proxy-only network path, or a different auth method) are not exposed, so real-world risk is configuration-dependent rather than universal. No EPSS score, KEV listing, or POC was supplied; absence of these suggests no confirmed widespread exploitation, but the vendor itself notes the behavior has been documented for years, so knowledge of the technique is effectively public. Treat as high priority for any deployment using proxy auth, and as low priority otherwise.

An attacker who can route to a proxy-authenticated File Browser instance directly (for example, an exposed container port or an internal host) sends an HTTP request with the proxy identity header set to the admin username. The server accepts the forged header without verifying the request came from the trusted proxy, granting full admin access to browse, modify, and delete files; supplying a novel username instead silently creates a fresh account. No public exploit code is required given the single-header technique, though none was identified at time of analysis.