CVE-2026-72837: File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-14 · updated 2026-09-08
Weakness: CWE-284

Description

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

Affected products

filebrowser: before 2.63.20 — fixed in 2.63.20

How to fix

Upgrade to a fixed version: filebrowser 2.63.20. Check the vendor advisory for mitigations.

References

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j7jh-37pf-mf8h
https://www.vulncheck.com/advisories/file-browser-before-privilege-escalation-via-proxy-authentication

Get alerted when CVE-2026-72837 or the next vulnerability affects your stack