CVE-2026-72835: filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filebrowserto a version that resolves this vulnerability.Fixed in 2.63.21Patch Access Rule Bypass via Path Canonicalization
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72835?
The severity of CVE-2026-72835 is medium with a CVSS score of 6.8.
How do I fix CVE-2026-72835?
To fix CVE-2026-72835, update Filebrowser to version 2.63.21 or later.
What type of vulnerability is CVE-2026-72835?
CVE-2026-72835 is an access rule bypass vulnerability due to path canonicalization issues.
Who is affected by CVE-2026-72835?
Authenticated users of Filebrowser versions prior to 2.63.21 are affected by CVE-2026-72835.
What can attackers do with CVE-2026-72835?
Attackers can bypass administrator-defined deny rules, potentially accessing restricted files using alternate path representations.