Is CVE-2026-35607 actively exploited?

No active exploitation of CVE-2026-35607 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-35607 be exploited remotely?

Yes. CVE-2026-35607 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-35607?

CVE-2026-35607 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-35607

HIGH

CVE-2026-35607

CWE-269Published: April 7, 2026· Updated: Apr 8, 2026

8.1

CVSS v3.1

EPSS:0.07%probability of exploitation in 30 daysPercentile:20.8th

Official Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the signup handler. The same fix was not applied to the proxy auth handler. Users auto-created on first successful proxy-auth login are granted execution capabilities from global defaults, even though the signup path was explicitly changed to prevent execution rights from being inherited by automatically provisioned accounts. This vulnerability is fixed in 2.63.1.

NVD Source

Technical Analysis

CVE-2026-35607 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.