CVE-2026-72837
HighCVSS 8.8Summary
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.
Risk Assessment
User isolation breach can lead to unauthorized access, modification, or deletion of data, posing a serious threat to data confidentiality and integrity.
Recommendation
Upgrade File Browser to version 2.63.20 or later, which includes the fix, and review proxy and hook authentication configurations.
Original NVD description (English source)
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.