Go/github.com/filebrowser/filebrowser/v2 CVE-2026-35607: unknown, EPSS 0.38%

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands in github.com/filebrowser/filebrowser

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.1 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.1

Affected

Fixed versions

Sources

• osv: GO-2026-5205#Go/github.com/filebrowser/filebrowser/v2
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp
• https://nvd.nist.gov/vuln/detail/CVE-2026-35607
• https://github.com/filebrowser/filebrowser/pull/5890

CVE-2026-35607 · published 2026-06-25T18:43:15Z · modified 2026-06-25T19:45:13.903729209Z · JSON