Is CVE-2026-72839 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-72839 being exploited in the wild.

How severe is CVE-2026-72839?

Critical severity, with a CVSS score of 9.8, published 13 August 2026.

Is there a fix for CVE-2026-72839?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-72839 attacked?

It is attacked over the network.

Am I affected by CVE-2026-72839?

Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-72839: filebrowser privilege escalation via self-signup

CVE-2026-72839 · Severity: critical · CVSS 9.8 · Published 2026-08-13

filebrowser is a lightweight file manager used to serve and manage files over a web interface. When self-signup is enabled with default settings, unauthenticated users can register accounts that automatically gain access to the entire server's file system with full permissions to read, modify, delete, and share all files—including those belonging to other users and sensitive system data.

Technologies: Filebrowser. Vendors: FileBrowser.

Quick answers

Is CVE-2026-72839 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-72839 being exploited in the wild.
How severe is CVE-2026-72839?: Critical severity, with a CVSS score of 9.8, published 13 August 2026.
Which products and versions are affected?: Filebrowser through 2.63.16.
Is there a fix for CVE-2026-72839?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-72839 attacked?: It is attacked over the network.
Am I affected by CVE-2026-72839?: Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the signup handler (POST /api/signup) due to improper permission initialization when self-registration is enabled. The code applies default settings (which set Scope to "/" and include full CRUD permissions), then only strips Admin, Execute, and Commands privileges—leaving Create, Modify, Delete, Rename, Share, and Download permissions intact. Additionally, when the default CreateUserDir setting is false, the Scope reset logic is bypassed, and path normalization causes "." to be converted to "/" (server root). As a result, any unauthenticated attacker can register an account and immediately access all files the server manages. No authentication, special configuration, or user interaction is required beyond enabling signup.

Affected products

filebrowser filebrowser through 2.63.16

Timeline

2026-07-25: disclosed: GitHub Security Advisory GHSA-6759-996p-gpj6 published
2026-08-13: advisory: CVE-2026-72839 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.