File Browser is a web‑based file management tool. Beginning with release 2.0.0‑rc.1, if the application is configured to use proxy authentication (auth.method=proxy), an attacker who can reach the server over HTTP can forge a single proxy‑authentication header. Because the server accepts the header unvalidated, the request is processed as the indicated user, allowing the attacker to impersonate any account, including the administrator. If the username supplied does not exist, the server automatically creates a new account, giving the attacker an account‑creation primitive with no authorization required.

The vulnerability affects the File Browser product (officially identified as). It is present in all releases from 2.0.0‑rc.1 onward; the precise fix version has not been published in the provided data.

The CVSS score of 9.1 indicates a high‑severity flaw. The EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog. A remote attacker can exploit it by sending a crafted HTTP request with a forged proxy‑authentication header to any host that can reach the File Browser instance. No additional credentials are required, and the attack can be performed from the internet if the service is exposed, making the risk significant for publicly reachable installations.