PT-2026-72006 · Unknown · Filebrowser
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
File Browser versions prior to 2.63.20
Description
An issue exists where the software fails to honor the
createUserDir isolation during proxy and hook authentication auto-provisioning paths. This allows attackers possessing valid upstream-authenticated credentials to exploit the server root scope assignment to read, modify, delete, and share files belonging to other users.Recommendations
Update to version 2.63.20 or later.
Exploit
Fix
LPE
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Filebrowser