CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.6
- CVSS vector
- CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.41%
- CWE
- CWE-41
- Published
- 2026-08-14
- Last modified
- 2026-08-14
Affected products
- filebrowser filebrowser
- filebrowser filebrowser
Weakness type
Related vulnerabilities
- CVE-2026-85978 — Unauthenticated Remote Code Execution in Akana API Platform
- CVE-2026-73019 — Windows URL Moniker Security Feature Bypass Vulnerability
- CVE-2026-66064 — goshs has ACL Bypass & Path Traversal
- CVE-2026-49401 — Deno Permission Bypass via Unicode Normalization Mismatch on macOS (APFS)
- CVE-2026-50568 — Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape
- CVE-2026-5816 — Improper Resolution of Path Equivalence in GitLab
- CVE-2026-34451 — Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories
- CVE-2026-23674 — MapUrlToZone Security Feature Bypass Vulnerability