CVE-2026-72839 filebrowser CVE debrief

Who should care

Defenders responsible for filebrowser instances, especially those with self-signup enabled, should assess exposure and prioritize remediation. This includes verifying the current version of filebrowser, reviewing configurations for self-signup and CreateUserDir settings, and applying necessary updates or mitigations. Security teams and vulnerability management teams should also review the vulnerability details and assess the potential impact on data, such.

Why it matters

CVE-2026-72839 allows unauthenticated attackers to register accounts with elevated permissions, potentially leading to unrestricted file access. Defenders should prioritize verifying exposure and remediation for filebrowser instances with self-signup enabled.

• Potential unrestricted access to all files.
• Possible account registration and privilege escalation.
• Required verification of exposure and remediation for filebrowser instances.
• Potential impact on data confidentiality, integrity, and availability.

Technical summary

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions. This vulnerability allows for potential unrestricted access to all files, emphasizing the need for defenders to verify exposure and prioritize remediation for filebrowser instances with self-signup enabled. Reviewing and limiting permissions for newly created user accounts and monitoring for unauthorized account registrations and file access attempts are crucial.

Defensive priority

Defenders should prioritize verifying exposure and remediation for filebrowser instances with self-signup enabled.

Recommended defensive actions

• Verify if filebrowser instances have self-signup enabled and default CreateUserDir setting.
• Assess exposure for filebrowser versions up to 2.63.16.
• Consider restricting or disabling self-signup for filebrowser instances.
• Review and limit permissions for newly created user accounts.
• Monitor for unauthorized account registrations and file access attempts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in filebrowser through 2.63.16. However, the corpus does not establish versions beyond 2.63.16, exploitation, impact, or remediation for all affected versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.