CVE-2026-72837 HIGH

CVE-2026-72837: File Browser before 2.63.20 Privilege Escalation via Proxy Authentication

Vendor Filebrowser

Product filebrowser

Weakness CWE-284

Published August 14, 2026

Last update August 14, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

Key dates

02Disclosure timeline

August 14, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-72837 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/284.html AskarLabs — CWE-284 write-up Improper Access Control

Related vulnerabilities

04Related CVE

CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task CVE-2026-64796 Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension CVE-2026-48957 Joomla! Core - [20260711] - Incorrect Access Control in com_privacy webservice endpoints CVE-2026-48948 Joomla! Core - [20260702] - Incorrect Access Control in com_contact vcf download CVE-2026-65888 Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2