Vulnerability · Published Aug 14, 2026 · Assigned by VulnCheck

CVE-2026-72835filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

Medium 6.8

In plain English

A medium-severity security flaw in filebrowser from filebrowser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 57.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

Affected products (as reported)

Vendor	Product	Versions
filebrowser	filebrowser	0 – before 2.63.21

Weakness: CWE-41 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-fgm5-pw99-w2p7) vendor-advisory
VulnCheck Advisory: filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization third-party-advisory