File Browser hat einen Zugriffregel-Umgehung über Path Traversal im Copy/Rename-Zielparameter.

An attacker exploiting this vulnerability can bypass administrator-configured deny rules, effectively gaining unauthorized access to files and directories within the Filebrowser instance. This could lead to data exfiltration, modification of critical files, or even the execution of arbitrary code if the attacker can leverage the file manipulation to inject malicious scripts or binaries. The potential blast radius depends on the sensitivity of the files stored and managed by Filebrowser, and the level of access granted to the authenticated user exploiting the vulnerability. While the vulnerability requires authentication, the ability to bypass access controls significantly expands the attack surface.

1. Reserviert2026-03-13
2. Veröffentlicht2026-03-16
3. Geändert2026-03-30
4. EPSS aktualisiert2026-03-27

The primary mitigation for CVE-2026-32758 is to upgrade Filebrowser to version 2.62.0 or later, which includes the necessary fix. If an immediate upgrade is not feasible, consider implementing stricter access controls within Filebrowser to limit the potential impact of a successful exploit. Review and harden existing deny rules to ensure they are as restrictive as possible. While a WAF might offer some protection, it's unlikely to be effective against this type of bypass, as the vulnerability lies within the application logic itself. Monitor Filebrowser logs for suspicious activity, particularly attempts to access files outside of expected directories.