Skip to main content

filebrowser EUVDEUVD-2026-58649

| CVE-2026-72835 HIGH
Improper Resolution of Path Equivalence (CWE-41)
2026-08-14 VulnCheck GHSA-8jx5-5rq8-69m2
Authentication Bypass Filebrowser
7.6
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
7.6 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
6.8 MEDIUM

Network-reachable but requires authenticated low-privilege user and specific filesystem/OS conditions (AC:H), with high confidentiality and integrity impact on denied files and no availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Patch available
Aug 14, 2026 - 13:01 EUVD
Analysis Generated
Aug 14, 2026 - 12:24 vuln.today
CVE Published
Aug 14, 2026 - 11:35 cve.org
HIGH 7.6

DescriptionCVE.org

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

AnalysisAI

Path canonicalization bypass in filebrowser before v2.63.21 permits authenticated users to circumvent administrator-configured deny rules by submitting case-variant or backslash-delimited path representations that the access rule engine fails to normalize before evaluation. The filesystem resolves these alternate representations to the same restricted objects, but the rules engine never matches them, effectively granting access to files the administrator explicitly intended to block. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Authenticate as low-privilege filebrowser user
Delivery
Identify administrator deny-rule protected path via enumeration
Exploit
Craft case-variant or backslash-delimited path string
Install
Submit HTTP request with alternate path representation
C2
Access rule engine finds no deny-rule match
Execute
OS resolves path to restricted filesystem object
Impact
Read or write denied file contents
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires three concurrent conditions: (1) the attacker must hold a valid filebrowser account (PR:L - unauthenticated access is not possible); (2) the administrator must have configured at least one deny rule for a path the attacker wishes to reach - deployments without deny rules are not affected; and (3) the server must run on a case-insensitive filesystem (e.g., Windows NTFS or macOS HFS+ in default mode) for the case-variant technique, or filebrowser must be running on Windows for the backslash-separator technique. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 7.6 reflects a meaningful but conditionally constrained risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An authenticated low-privilege filebrowser user targets a directory the administrator has added to a deny list, such as '/admin-only/payroll/'. The user requests '/Admin-Only/Payroll/' (case-variant) or '/admin-only\payroll/' (backslash separator) through the filebrowser API. …
Remediation Upgrade filebrowser to v2.63.21 or later, which introduces path canonicalization prior to access rule evaluation, per vendor advisory GHSA-fgm5-pw99-w2p7 (https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fgm5-pw99-w2p7). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: audit which users have active filebrowser credentials and document all files or directories subject to administrator-configured deny rules to identify exposure scope. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Filebrowser

View all
CVE-2026-29188 CRITICAL POC
9.1 Mar 05

Unauthorized file operations in File Browser before fix. PoC and patch available.
CVE-2023-39612 CRITICAL POC
9.0 Sep 16

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
CVE-2026-25890 HIGH POC
8.1 Feb 09

Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
CVE-2025-52995 HIGH POC
8.0 Jun 30

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2026-73611 HIGH POC
7.6 Aug 13

File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
CVE-2025-52902 HIGH POC
7.6 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2026-73613 HIGH POC
7.2 Aug 13

Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
CVE-2026-28492 MEDIUM POC
6.5 Mar 05

File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
CVE-2025-52997 MEDIUM POC
5.9 Jun 30

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2025-52900 MEDIUM POC
5.5 Jun 26

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
CVE-2026-25889 MEDIUM POC
5.4 Feb 09

Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password
CVE-2026-48777 CRITICAL
9.3 Jun 16

Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta all

Same weakness CWE-41 – Improper Resolution of Path Equivalence

View all
CVE-2026-5816 HIGH POC
8.0
CVE-2022-0855 MEDIUM POC
6.1
CVE-2024-6839 MEDIUM POC
5.3
CVE-2025-24470 HIGH
8.6
CVE-2026-49401 HIGH
8.4
CVE-2024-30073 HIGH
7.8
CVE-2025-43298 HIGH
7.8
CVE-2023-36396 HIGH
7.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

EUVD-2026-58649 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy