CVE WatchAug 14, 2026

CVE-2026-72835

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass admin

CVSS

6.8

Medium

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 14, 2026 · Last modified: Aug 14, 2026 · CWE-41

EPSS · 30d

Not enough EPSS history yet.

Technical description

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no rule but resolve to the same filesystem object, gaining unauthorized access to denied files within their scope.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-660645.3 MED

23.3%

——7goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/handler.go sendFile handler opened files using a cleaned path but derived the authorization filename from raw req.URL.Path, so a trailing slash could bypass .goshs ACL-file protection and block-list checks. This issue is fixed in version 2.1.5.15d CVE-2026-344515.4 MED

27.8%

——8Claude SDK for TypeScript provides access to the Claude API from server-side TypeScript or JavaScript applications. From version 0.79.0 to before version 0.81.0, the local filesystem memory tool in the Anthropic TypeScript SDK validated model-supplied paths using a string prefix check that did not append a trailing path separator. A model steered by prompt injection could supply a crafted path that resolved to a sibling directory sharing the memory root's name as a prefix, allowing reads and writes outside the sandboxed memory directory. This issue has been patched in version 0.81.0.21d CVE-2024-300737.8 HIG

56.5%

——17Windows Security Zone Mapping Security Feature Bypass Vulnerability4d