CVE-2026-72837 — File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authentica…
Published: 2026-08-14 · CVSS: 8.7 · CVSS 4.0
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7