CVE-2026-35607

Go/github.com/filebrowser/filebrowser/v2 CVE-2026-35607: high 8.1, EPSS 0.56%

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.1 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.1

Affected

Fixed versions

Sources

• osv: GHSA-7526-j432-6ppp
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp
• https://nvd.nist.gov/vuln/detail/CVE-2026-35607
• https://github.com/filebrowser/filebrowser/pull/5890
• https://github.com/filebrowser/filebrowser

CVE-2026-35607 · published 2026-04-08T00:05:12Z · modified 2026-07-21T13:47:07Z · JSON

Go/github.com/filebrowser/filebrowser CVE-2026-35607: unknown, EPSS 0.56%

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands in github.com/filebrowser/filebrowser

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GO-2026-5205
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp
• https://nvd.nist.gov/vuln/detail/CVE-2026-35607
• https://github.com/filebrowser/filebrowser/pull/5890

CVE-2026-35607 · published 2026-06-25T18:43:15Z · modified 2026-06-25T19:45:13.903729209Z · JSON

Go/github.com/filebrowser/filebrowser/v2 CVE-2026-35607: unknown, EPSS 0.56%

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands in github.com/filebrowser/filebrowser

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.1 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.1

Affected

Fixed versions

Sources

• osv: GO-2026-5205#Go/github.com/filebrowser/filebrowser/v2
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-7526-j432-6ppp
• https://nvd.nist.gov/vuln/detail/CVE-2026-35607
• https://github.com/filebrowser/filebrowser/pull/5890

CVE-2026-35607 · published 2026-06-25T18:43:15Z · modified 2026-06-25T19:45:13.903729209Z · JSON