CVE-2026-72835

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to 2.63.21

Description Authenticated users can bypass administrator-defined deny rules because the software fails to canonicalize paths before evaluating access rules. Path canonicalization is the process of converting a file path into a standard, unique representation. By using case-variant or backslash-separated paths, attackers can request files with alternate representations that do not match any deny rules but still resolve to the same filesystem object, resulting in unauthorized access to restricted files within their scope.

Recommendations Update to version 2.63.21 or later.