# CVE-2026-72839: filebrowser privilege escalation via self-signup

Source: https://junglewise.ai/threats/cve-2026-72839-filebrowser-privilege-escalation-via-self-signup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72839 · Severity: critical · CVSS 9.8 · Published 2026-08-13

filebrowser is a lightweight file manager used to serve and manage files over a web interface. When self-signup is enabled with default settings, unauthenticated users can register accounts that automatically gain access to the entire server's file system with full permissions to read, modify, delete, and share all files—including those belonging to other users and sensitive system data.

Technologies: [Filebrowser](https://junglewise.ai/threats/technologies/filebrowser). Vendors: [FileBrowser](https://junglewise.ai/threats/vendors/filebrowser).

## Quick answers

**Is CVE-2026-72839 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72839 being exploited in the wild.

**How severe is CVE-2026-72839?** Critical severity, with a CVSS score of 9.8, published 13 August 2026.

**Which products and versions are affected?** Filebrowser through 2.63.16.

**Is there a fix for CVE-2026-72839?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72839 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72839?** Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the signup handler (POST /api/signup) due to improper permission initialization when self-registration is enabled. The code applies default settings (which set Scope to "/" and include full CRUD permissions), then only strips Admin, Execute, and Commands privileges—leaving Create, Modify, Delete, Rename, Share, and Download permissions intact. Additionally, when the default CreateUserDir setting is false, the Scope reset logic is bypassed, and path normalization causes "." to be converted to "/" (server root). As a result, any unauthenticated attacker can register an account and immediately access all files the server manages. No authentication, special configuration, or user interaction is required beyond enabling signup.

## Affected products

- filebrowser filebrowser through 2.63.16

## Timeline

- 2026-07-25: disclosed: GitHub Security Advisory GHSA-6759-996p-gpj6 published
- 2026-08-13: advisory: CVE-2026-72839 published on NVD

## References

- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6759-996p-gpj6)
- [https://www.vulncheck.com/advisories/filebrowser-through-privilege-escalation-via-signup](https://www.vulncheck.com/advisories/filebrowser-through-privilege-escalation-via-signup)

## Related threats

- [filebrowser WebSocket message denial of service in /api/command](https://junglewise.ai/threats/cve-2026-90927-filebrowser-websocket-message-denial-of-service-in-api-command)
- [filebrowser race condition in TUS upload handler](https://junglewise.ai/threats/cve-2026-82238-filebrowser-race-condition-in-tus-upload-handler)
- [filebrowser stale share link via file rename](https://junglewise.ai/threats/cve-2026-82237-filebrowser-stale-share-link-via-file-rename)
- [filebrowser named pipe blocking in archive and public download handlers](https://junglewise.ai/threats/cve-2026-82235-filebrowser-named-pipe-blocking-in-archive-and-public-download)
- [filebrowser out-of-scope file deletion via symlink in TUS cache eviction](https://junglewise.ai/threats/cve-2026-73613-filebrowser-out-of-scope-file-deletion-via-symlink-in-tus-cache)