Description

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-14T12:16:46.930Z",
  "pubdate": "2026-08-14T12:16:46.930Z",
  "executiveSummary": "A path canonicalization vulnerability exists in filebrowser versions before v2.63.21, allowing authenticated users to bypass administrator-defined access control deny rules.\nThe vulnerability enables unauthorized access to sensitive filesystem objects by exploiting discrepancies in how paths are evaluated against security policies versus how they are resolved by the underlying filesystem.\nAffected products include filebrowser prior to version v2.63.21.\nThe risk implications involve the compromise of confidentiality, as attackers can read files that administrators explicitly intended to restrict.\nAttacker capabilities require authenticated access to the application, allowing them to leverage alternate path representations.\nExploitation requirements necessitate that the attacker possesses valid authentication credentials and crafts requests using non-canonical path formats such as case-variant or backslash-separated strings that evade string-matching access rules while resolving to restricted resources.",
  "technicalDetails": "The root cause of the vulnerability stems from a failure to properly canonicalize file paths prior to evaluating administrative access rules and permission checks.\nThe vulnerable component is responsible for path parsing and access control enforcement within filebrowser.\nAffected software versions are all releases of filebrowser prior to v2.63.21.\nAuthentication requirements dictate that the attacker must be an authenticated user within the system.\nPrivilege requirements are limited to standard authenticated access, granting the ability to interact with the file browsing interface.\nNetwork exposure is inherent to the web-based nature of filebrowser, requiring network reachability to the application instance.\nThe attack flow proceeds as follows: First, an administrator defines explicit deny rules intended to restrict access to specific sensitive files or directories based on exact path strings. Second, an authenticated attacker crafts an HTTP request targeting a restricted file, substituting the standard path with an alternate representation such as a case-variant string or a path utilizing backslash separators. Third, the access control evaluation engine compares the raw, non-canonicalized request path against the configured deny rules. Because the input does not strictly match the string pattern of the deny rule, the access control check incorrectly permits the request. Fourth, the application subsequently processes the path and resolves it to the underlying filesystem object. Finally, the filesystem resolves the alternate representation to the actual restricted file, returning its contents to the unauthorized user and resulting in a complete bypass of the security policy."
}