CVE-2026-72835

The record

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

Affected packages

Related vulnerabilities

• CVE-2026-85978 An unauthenticated remote code execution vulnerability exists in the Policy Manager… CWE-41
• CVE-2026-49401 Deno is a JavaScript, TypeScript, and WebAssembly runtime. CWE-41
• GHSA-j99q-93c9-h869 MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing… CWE-41
• GHSA-8xpq-cjcf-3wh9 Deno: Permission Bypass via Unicode Normalization Mismatch on macOS (APFS) CWE-41
• CVE-2026-50568 Fission is an open-source, Kubernetes-native serverless framework that simplifies the… CWE-41
• CVE-2026-5816 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.10 before… CWE-41
• GHSA-5474-4w2j-mq4c Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling… CWE-41
• CVE-2026-34510 OpenClaw before 2026.3.22 contains a path traversal vulnerability in Windows media… CWE-41