CVE-2026-72835: 
Wolfi vulnerability analysis and mitigation

CVE-2026-72835 is an access rule bypass vulnerability in filebrowser (the open-source web-based file manager) caused by failure to canonicalize paths before evaluating administrator-defined access rules. Authenticated users can bypass deny rules by submitting case-variant or backslash-separated path representations that resolve to the same filesystem object but match no configured rule. All filebrowser versions before v2.63.21 are affected across the 2.x line. The vulnerability was disclosed on August 14, 2026, with a CVSS v3.1 base score of 6.8 (Medium) and a CVSS v4.0 base score of 7.6 (High) (GitHub Advisory, GitHub DB).

The root cause is classified as CWE-41 (Improper Resolution of Path Equivalence), with additional weaknesses CWE-178 (Improper Handling of Case Sensitivity) and CWE-180 (Incorrect Behavior Order: Validate Before Canonicalize). The rules.Rule.Matches function in rules/rules.go performed case-sensitive, literal string comparisons on the raw, uncanonicalized path received from the client, while the underlying filesystem (e.g., NTFS, macOS APFS/HFS+) resolved paths with host semantics — creating a disagreement between the rule checker and the filesystem. Two independent exploitation forms exist: (1) on case-insensitive filesystems, a case-variant of a denied path (e.g., SECRET.TXT instead of Secret.txt) matches no rule but resolves to the same file; (2) on Windows, backslash path separators (e.g., /allow\..\.\Secret.txt) are resolved by afero.BasePathFs.RealPath via filepath.Clean/filepath.Join but were treated as ordinary characters by the rule checker, enabling traversal to denied files. The destination= and files= query parameters were also affected (GitHub Advisory).

A successfully exploited vulnerability allows any authenticated user to bypass administrator-defined access deny rules within their own scope, gaining unauthorized read access (disclosure), write access (modification), deletion, copying, or public sharing of files the administrator explicitly restricted. The impact is limited to the user's assigned scope — it does not grant access to files outside that scope or enable privilege escalation to other users' scopes. Confidentiality and integrity impacts are rated High, while availability is unaffected (GitHub Advisory, GitHub DB).

CISA's SSVC assessment classifies exploitation status as "poc" (proof-of-concept exists), though no public PoC code has been independently confirmed and no in-the-wild exploitation has been observed at the time of disclosure (GitHub DB). The vulnerability is not automatable (requires authenticated access) and is not listed in the CISA KEV catalog. The EPSS score is approximately 0.338% (27th percentile), indicating a relatively low near-term exploitation probability. No threat actor attribution has been reported (GitHub Advisory).

1. Identify target: Locate a filebrowser instance running a version before v2.63.21, ideally hosted on Windows or a case-insensitive filesystem (NTFS, macOS APFS/HFS+, or a case-insensitive Linux mount).
2. Authenticate: Log in as a normal authenticated user whose scope includes the directory containing the denied file (e.g., a user with access to / but with an administrator deny rule for /Secret.txt).
3. Confirm denial: Request the canonical path (e.g., GET /api/resources/Secret.txt) and verify the server returns a denial/403 response, confirming the deny rule is active.
4. Case-variant bypass (case-insensitive filesystem): Modify the filename casing in the request (e.g., GET /api/resources/SECRET.TXT or /api/resources/secret.txt). The rule checker finds no matching deny rule for the variant, while the filesystem resolves it to the same file, returning its contents.
5. Backslash-separator bypass (Windows): Craft a request using a backslash-separated path that traverses to the denied file via an allowed directory (e.g., GET /api/resources/allow\..\.\Secret.txt). The rule checker evaluates the uncanonicalized string and finds no match for /Secret.txt, while filepath.Clean/filepath.Join on the server resolves it to the actual file.
6. Exfiltrate or modify: Use the bypassed access to read, download, modify, delete, or share the restricted file, depending on the permissions granted to the authenticated user (GitHub Advisory).

• Network: HTTP requests to filebrowser API endpoints (e.g., /api/resources/, /api/raw/) with filenames containing mixed case variants of known sensitive files (e.g., SECRET.TXT, Config.JSON) or backslash characters in path segments (e.g., allow%5C..%5CSecret.txt).
• Logs: filebrowser access logs showing successful (HTTP 200) responses to requests for files that should have been denied, particularly where the requested path differs in case from the canonical filename; repeated access attempts with slight path variations from the same authenticated user.
• Logs: Requests containing URL-encoded backslashes (%5C) or literal backslashes in path parameters (destination=, files=) that resolve to sensitive file locations.
• File System: Unexpected access timestamps on files covered by administrator deny rules, indicating reads or modifications that should not have occurred under normal access control enforcement (GitHub Advisory).

Upgrade filebrowser to v2.63.21 or later, which fixes the issue by canonicalizing paths using the host's own separator before every rule evaluation and at each point an external path enters the system. The fix also adds case-insensitive rule matching when the filesystem is detected as case-insensitive (probed at startup rather than inferred from the OS). There are no supported workarounds — the vendor explicitly states that upgrading is the only remediation. Administrators relying on access rules on Windows should additionally disable 8.3 short-name generation on served volumes (fsutil 8dot3name set 1) as a defense-in-depth measure, since NTFS short names (e.g., SECRET~1.TXT) remain out of scope for the fix (GitHub Advisory).

The vulnerability was reported by researcher N1V6 and remediated by filebrowser maintainer hacdias, who published the advisory and fix (PR #6045) on July 27, 2026. CISA-ADP added the GitHub advisory reference and an SSVC assessment on August 14, 2026, classifying technical impact as "total." No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (GitHub Advisory).