CVE-2026-72835

Published: Aug 14, 2026Modified: Sep 8, 2026Deferred

7.6

Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

Related CWEs

CWE-41

Improper Resolution of Path Equivalence

The product is vulnerable to file system contents disclosure through path equivalence. Path equivalence involves the use of special characters in file and directory names. The associated manipulations are intended to generate multiple names for the same object.

References (3)

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fgm5-pw99-w2p7

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/filebrowser-before-access-rule-bypass-via-path-canonicalization

Source: disclosure@vulncheck.com

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-fgm5-pw99-w2p7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.