Path Canonicalization Vulnerability in Filebrowser by Filebrowser

CVE-2026-72835

What is CVE-2026-72835?

Filebrowser versions prior to v2.63.21 exhibit a vulnerability in which they fail to properly canonicalize file paths before applying access control rules. This flaw allows authenticated users to exploit alternate representations of paths—such as case variations or backslashes—that bypass intended deny rules. As a result, malicious actors can potentially access files that should be restricted, leading to unauthorized file access within their allowed scope.

References