← Vulnerability feed

Vulnerability record · CVE-2026-32758 · published 20 March 2026

CVE-2026-32758: Filebrowser path traversal vulnerability

Filebrowser · Filebrowser

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against access rules before being cleaned/normalized, while the actual file operation calls path.Clean() afterward—resolving .. sequences into a different effective path. This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules (both prefix-based and regex-based) by injecting .. sequences in the destination parameter of a PATCH request. As a result, the user can write or move files into any deny-rule-protected path within their scope. However, this cannot be used to escape the user's BasePathFs scope or read from restricted paths. This issue has been fixed in version 2.62.0.

6.5 CVSS 3.1 Medium EPSS 0.44% · top 63.9% CWE-22 · Path traversalCWE-863 · Incorrect authorization
6.5CVSS 3.1 base score
0.44%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
3References
17 Jun 2026Last modified by NVD

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against access rules before being cleaned/normalized, while the actual file operation calls path.Clean() afterward—resolving .. sequences into a different effective path. This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules (both prefix-based and regex-based) by injecting .. sequences in the destination parameter of a PATCH request. As a result, the user can write or move files into any deny-rule-protected path within their scope. However, this cannot be used to escape the user's BasePathFs scope or read from restricted paths. This issue has been fixed in version 2.62.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/filebrowser/filebrowser/commit/4bd7d69c82163b201a987e99c0c50d7ecc6ee5f1 Patch
https://github.com/filebrowser/filebrowser/releases/tag/v2.62.0 ProductRelease Notes
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-9f3r-2vgw-m8xp MitigationVendor Advisory

Track CVE-2026-32758 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-32760Filebrowser improper privilege management vulnerabilityFile Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions …EPSS 0.69%9.8CVE-2026-34528Filebrowser improper privilege management vulnerabilityFile Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to ver…EPSS 0.66%9.0CVE-2026-34529Filebrowser cross-site scripting vulnerabilityFile Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to ver…EPSS 0.39%9.0CVE-2023-39612Filebrowser cross-site scripting vulnerabilityA cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via…EPSS 0.88%8.8CVE-2026-35607Filebrowser improper privilege management vulnerabilityFile Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.6…EPSS 0.56%8.8CVE-2021-46398Filebrowser cross-site request forgery vulnerabilityA Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and ge…EPSS 6.7%8.2CVE-2026-35604Filebrowser incorrect authorization vulnerabilityFile Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.6…EPSS 0.43%8.1CVE-2026-29188Filebrowser improper access control vulnerabilityFile Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Pr…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2026-32758), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.