CVE-2026-35607 - Vulnerability Analysis

Overview

File Browser < 2.63.1 contains a broken access control vulnerability caused by inconsistent permission handling in proxy auth handler, letting auto-created users gain unintended execute permissions, exploit requires proxy-auth login.

Severity & Score

Impact

Auto-created users gain execute permissions, potentially allowing unauthorized command execution and privilege escalation.

Mitigation

Update to version 2.63.1 or later.

References

• https://github.com/filebrowser/filebrowser/pull/5890
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner