filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass… (CVE-2026-72835)
filebrowser versions prior to v2.63.21 do not properly canonicalize file paths before applying access control rules. This flaw allows authenticated users to bypass administrator-defined deny rules by using alternate path representations, such as case variants or backslash separators, to access files that should be denied.
AI Analysis
Technical Summary
The vulnerability in filebrowser before version v2.63.21 involves a failure to canonicalize file paths before evaluating access rules. As a result, authenticated users can craft requests with alternate path formats that do not match any deny rules but resolve to the same filesystem object. This allows unauthorized access to files within the user's scope that are intended to be denied by administrator policies. The issue is identified as CWE-41 (Improper Neutralization of Special Elements in Pathnames).
Potential Impact
An attacker with authenticated access can bypass deny rules configured by administrators and gain unauthorized read access to files that should be restricted. This can lead to exposure of sensitive information. The CVSS v3.1 score is 6.8 (High), reflecting network attack vector, high impact on confidentiality and integrity, but requiring low privileges and high attack complexity.
Mitigation Recommendations
A fix is available in filebrowser version v2.63.21. Users should upgrade to v2.63.21 or later to address this vulnerability. Since no vendor advisory or patch links are provided, verify the patch status with the official filebrowser project resources before applying.
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass… (CVE-2026-72835)
Description
filebrowser versions prior to v2.63.21 do not properly canonicalize file paths before applying access control rules. This flaw allows authenticated users to bypass administrator-defined deny rules by using alternate path representations, such as case variants or backslash separators, to access files that should be denied.
CVSS v3.1
Score 6.8medium
Affected software
pkg:github/filebrowser/filebrowserRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in filebrowser before version v2.63.21 involves a failure to canonicalize file paths before evaluating access rules. As a result, authenticated users can craft requests with alternate path formats that do not match any deny rules but resolve to the same filesystem object. This allows unauthorized access to files within the user's scope that are intended to be denied by administrator policies. The issue is identified as CWE-41 (Improper Neutralization of Special Elements in Pathnames).
Potential Impact
An attacker with authenticated access can bypass deny rules configured by administrators and gain unauthorized read access to files that should be restricted. This can lead to exposure of sensitive information. The CVSS v3.1 score is 6.8 (High), reflecting network attack vector, high impact on confidentiality and integrity, but requiring low privileges and high attack complexity.
Mitigation Recommendations
A fix is available in filebrowser version v2.63.21. Users should upgrade to v2.63.21 or later to address this vulnerability. Since no vendor advisory or patch links are provided, verify the patch status with the official filebrowser project resources before applying.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-8jx5-5rq8-69m2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-72835"]
- Ecosystems
- []
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
Threat ID: 6a7f43ffbf8831d5395f3d04
Added to database: 08/14/2026, 16:36:15 UTC
Last enriched: 08/14/2026, 16:55:57 UTC
Last updated: 08/14/2026, 17:21:15 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.