filebrowser vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-90930 File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing autheHigh 7.6 · Sep 14, 2026
• CVE-2026-90929 File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go).High 7.2 · Sep 14, 2026
• CVE-2026-90928 File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory withoutHigh 7.1 · Sep 14, 2026
• CVE-2026-90927 filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffeHigh 7.1 · Sep 14, 2026
• CVE-2026-82235 filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscallHigh 8.2 · Aug 28, 2026
• CVE-2026-72838 FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to writeHigh 7.1 · Aug 14, 2026
• CVE-2026-72837 File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths.High 8.7 · Aug 14, 2026
• CVE-2026-72836 FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration.Critical 9.2 · Aug 14, 2026
• CVE-2026-72835 filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined denHigh 7.6 · Aug 14, 2026
• CVE-2026-72839 filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting.Critical 9.3 · Aug 13, 2026
• CVE-2026-73613 filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated useHigh 7.2 · Aug 13, 2026
• CVE-2026-73612 File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users tHigh 8.6 · Aug 13, 2026
• CVE-2026-73611 File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page.High 7.6 · Aug 13, 2026
• CVE-2026-62685 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 8.1 · Jul 15, 2026
• CVE-2026-55667 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 8.2 · Jun 25, 2026
• CVE-2026-54097 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 7.2 · Jun 25, 2026
• CVE-2026-54096 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 8.4 · Jun 25, 2026
• CVE-2026-54094 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 7.5 · Jun 25, 2026
• CVE-2026-54091 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 7.5 · Jun 25, 2026
• CVE-2026-54090 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 8.7 · Jun 25, 2026
• CVE-2026-54089 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.Critical 9.1 · Jun 25, 2026
• CVE-2026-54088 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.Critical 9.3 · Jun 25, 2026
• CVE-2026-35607 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 8.1 · Apr 7, 2026
• CVE-2026-35604 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 8.2 · Apr 7, 2026
• CVE-2026-35585 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.High 7.5 · Apr 7, 2026