Is CVE-2026-32758 actively exploited?

No active exploitation of CVE-2026-32758 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-32758 be exploited remotely?

Yes. CVE-2026-32758 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-32758?

CVE-2026-32758 has a CVSS score of 6.5 (MEDIUM).

HOME VULNERABILITIESCVE-2026-32758

MEDIUM

CVE-2026-32758

CWE-22Published: March 20, 2026· Updated: Mar 23, 2026

6.5

CVSS v3.1

EPSS:0.01%probability of exploitation in 30 daysPercentile:1.1th

Official Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against access rules before being cleaned/normalized, while the actual file operation calls path.Clean() afterward—resolving .. sequences into a different effective path. This allows an authenticated user with Create or Rename permissions to bypass administrator-configured deny rules (both prefix-based and regex-based) by injecting .. sequences in the destination parameter of a PATCH request. As a result, the user can write or move files into any deny-rule-protected path within their scope. However, this cannot be used to escape the user's BasePathFs scope or read from restricted paths. This issue has been fixed in version 2.62.0.

NVD Source

Technical Analysis

CVE-2026-32758 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in full integrity compromise (data manipulation), with a CVSS base score of 6.5.