CVE-2026-35607 — AI Deep Analysis Summary

🚨 **Essence**: Flaw in proxy authentication logic. 💥 **Consequence**: New users are incorrectly granted **execute privileges**, leading to **privilege escalation**. 📉 **Impact**: Attackers can bypass privilege restrictio…

🔍 **CWE**: Logic error / permission management flaw. 🛠️ **Defect**: The proxy authentication handler **did not apply** the same patch as the registration handler. ⚠️ **Core**: Inconsistent code logic allows security poli…

📦 **Component**: File Browser (open-source file management interface). 📅 **Version**: All versions **prior to 2.63.1**. 🌐 **Scenario**: Deployment environments where the proxy authentication feature is enabled.

👑 **Privilege**: Gains **execute capabilities**. 📂 **Data**: Can upload, delete, and edit arbitrary files. 💣 **Consequence**: Full control over the server file system, potentially leading to RCE.

🔑 **Authentication**: No pre-existing account required (auto-created on first login). 🌐 **Network**: Attemptable if network reachable. 📉 **Difficulty**: **High** (AC:H), requiring specific proxy configuration, but high-r…

📜 **Exploit**: No public PoC or ready-made exploit available at present. 🕵️ **In the Wild**: No in-the-wild exploitation reports as of now. 🔗 **Reference**: GitHub Advisory GHSA-7526-j432-6ppp.

🔎 **Self-check**: Verify if File Browser version is < 2.63.1. ⚙️ **Configuration**: Confirm if **proxy authentication** is enabled. 📡 **Scan**: Use Nessus/AWVS to scan the file management component version.

🛡️ **Patch**: Officially fixed. 📥 **Upgrade**: Upgrade to **File Browser 2.63.1** or later. 🔗 **Link**: GitHub PR #5890.

🚧 **Temporary**: Disable the **proxy authentication** feature. 🔒 **Restriction**: Limit access IPs, allowing only internal network access. 👥 **Monitoring**: Monitor new user creation logs and check privilege assignments.

🔥 **Priority**: **High** (CVSS 8.6). ⚡ **Recommendation**: Upgrade immediately! 📢 **Reason**: Privilege escalation vulnerability directly threatens server security and does not require complex exploitation conditions.