PT-2026-72006

CVE-2026-72837

Published

2026-08-14

Updated

2026-08-14

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.20

Description An issue exists where the software fails to honor the createUserDir isolation during proxy and hook authentication auto-provisioning paths. This allows attackers possessing valid upstream-authenticated credentials to exploit the server root scope assignment to read, modify, delete, and share files belonging to other users.

Recommendations Update to version 2.63.20 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

B1Gn0Se

Hacdias

Thesmartshadow

Vendors

Affected products

Weakness enumeration