PatchTheCVECVE-2026-35607: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit
CVE-2026-35607 is a high-severity flaw (CVSS 8.1) affecting filebrowser. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the signup handler. The same fix was not applied to the proxy auth handler. Users auto-created on first successful proxy-auth login are granted execution ca
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 68%) |
| CISA exploited list | No |
| Weakness | CWE-269 |
| Published | 2026-04-07 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-35607?
filebrowser: upgrade to newer than 2.63.0. Exact commands for each OS are on this page.
Is CVE-2026-35607 being exploited?
CVE-2026-35607 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-35607 affect?
CVE-2026-35607 affects filebrowser. Severity is high (CVSS 8.1). File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped E
How urgent is CVE-2026-35607?
Priority 46/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2026-35606 HIGH 7.5 UPGRADE File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit
- CVE-2026-35605 HIGH 7.5 UPGRADE File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit
- CVE-2026-35604 HIGH 8.1 UPGRADE File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit
- CVE-2026-35585 HIGH 7.2 UPGRADE File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit
- CVE-2026-34530 MEDIUM 6.9 UPGRADE File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit