CVE-2026-72839criticalCWE-266

CVE-2026-72839: critical vulnerability in filebrowser

filebrowser through 2.63.16 Privilege Escalation via Signup

Published · Updated

Follow this CVE+ Monitor filebrowser

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.3epss 0.6%
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions, allowing unrestricted access to all files.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
filebrowser · filebrowser
Related CVEs — filebrowser

In the same product, most dangerous first.

CVE-2026-32759MEDIUMFile Browser TUS Negative Upload-Length Fires Post-Upload Hooks PrematurelyEPSS 1.9%CVE-2026-35585HIGHFile Browser has a Command Injection via Hook RunnerEPSS 1.9%CVE-2025-52903HIGHFile Browser Allows Execution of Shell Commands That Can Spawn Other CommandsEPSS 1.2%CVE-2025-52904HIGHFile Browser: Command Execution not Limited to ScopeEPSS 1.1%CVE-2026-54088CRITICALFile Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)EPSS 0.8%CVE-2026-34528HIGHFile Browser's Signup Grants Execution Permissions When Default Permissions Includes ExecutionEPSS 0.7%