Vendor
Authorization Bypass in File Browser via Recursive Operations
1 rule 2 TTPs 1 CVEFile Browser versions prior to 2.63.22 contain an authorization bypass vulnerability allowing authenticated users to manipulate restricted files via recursive copy, rename, and delete operations.
Path Traversal in FileBrowser Subtitle Handler
1 rule 2 TTPs 1 CVEAn unauthenticated-accessible path traversal vulnerability in FileBrowser's subtitle handler allows authenticated users to read arbitrary files from the host filesystem, leading to potential credential theft and privilege escalation.
FileBrowser Username Normalization Collision Leads to Authorization Bypass
4 TTPs 1 CVEA critical authorization bypass vulnerability, CVE-2026-62685, in FileBrowser versions <= 2.63.16 enables an attacker to gain full read and write access to other users' files by exploiting a username normalization collision during self-registration, thus bypassing per-user isolation and allowing data tampering or exfiltration.
File Browser Symlink Following Vulnerability Allows Out-of-Scope File Deletion (CVE-2026-55667)
2 TTPs 2 CVEsA File Browser user with only `Create` permission can exploit CVE-2026-55667, an incomplete fix for CVE-2026-54094, to delete arbitrary files and directories outside their authorized scope by abusing the `ScopedFs.RemoveAll` function's symlink-following behavior during failed upload cleanup, leading to data loss, cross-tenant data deletion, or denial of service.
FileBrowser Authentication Bypass via Forged Proxy Authentication Header
1 rule 3 TTPsAn unauthenticated attacker can impersonate any user, including administrators, or automatically create new user accounts in FileBrowser by forging the `X-Remote-User` HTTP header when the server is configured for proxy authentication and is directly reachable, leading to full administrative control and unauthorized access to data.