Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-72837

File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

filebrowser filebrowser

Default version status: unaffected

  • 0 to < 2.63.20affected
  • 2.63.20unaffected
pkg:golang/github.com/filebrowser/filebrowser/v2

References