CVE-2026-35607

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the signup handler. The same fix was not applied to the proxy auth handler. Users auto-created on first successful proxy-auth login are granted execution capabilities from global defaults, even though the signup path was explicitly changed to prevent execution rights from being inherited by automatically provisioned accounts. This vulnerability is fixed in 2.63.1.

• CWE-269

• https://github.com/filebrowser/filebrowser/pull/5890Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6pppExploit, Vendor Advisory
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6pppExploit, Vendor Advisory

Published

Apr 7, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35601Vikunja is an open-source self-hosted task management platfo…4.1
• CVE-2026-35602Vikunja is an open-source self-hosted task management platfo…7.1
• CVE-2026-35603Claude Code is an agentic coding tool. In versions prior to …7.3
• CVE-2026-35604File Browser is a file managing interface for uploading, del…8.1
• CVE-2026-35605File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-35606File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-35608QuickDrop is an easy-to-use file sharing application. Prior …6.1
• CVE-2026-3561Philips Hue Bridge hk_hap characteristics Heap-based Buffer …8
• CVE-2026-35610PolarLearn is a free and open-source learning program. In 0-…8.8
• CVE-2026-35611Addressable is an alternative implementation to the URI impl…7.5
• CVE-2026-35613coursevault-preview is a utility for previewing course mater…4.7
• CVE-2026-35614Frappe is a full-stack web application framework. Prior to 1…9.8