CVEvulnerability

CVE-2026-72835

7.6 HIGH Published 2026-08-14 Modified 2026-09-08 Official page ↗
Status
Deferred
Published
2026-08-14
Last modified
2026-09-08
Assigner
[email protected]
CVSS 4.0 ([email protected])
7.6 HIGH — CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1 ([email protected])
6.8 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-41

Description

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

Related

Weakness · CWE (1)

  • CWE-41 Improper Resolution of Path Equivalence weakness

References