What is GHSA-6x93-4cv7-m749?

GHSA-6x93-4cv7-m749 is a security advisory published by GitHub Security Advisories with High severity. File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook...

Which CVE IDs does GHSA-6x93-4cv7-m749 cover?

GHSA-6x93-4cv7-m749 covers the following CVE IDs: CVE-2026-72837. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-6x93-4cv7-m749?

GHSA-6x93-4cv7-m749 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-6x93-4cv7-m749HighCVSS 8.8

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook...

Vendor

GitHub Security Advisories

Published

August 14, 2026

Last Modified

August 14, 2026

🔗 CVE IDs covered (1)

CVE-2026-72837 →

📋 Description

File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment.

🔗 References (4)

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-j7jh-37pf-mf8h
https://nvd.nist.gov/vuln/detail/CVE-2026-72837
https://www.vulncheck.com/advisories/file-browser-before-privilege-escalation-via-proxy-authentication
https://github.com/advisories/GHSA-6x93-4cv7-m749