Filebrowser vulnerabilities
61 CVEs and advisories name Filebrowser as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-90930File Browser through 2.63.23 Path Traversal via Symlink Alias
- CVE-2026-90929File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup
- CVE-2026-90928File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
- CVE-2026-90927filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
- CVE-2026-82238filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads
- CVE-2026-82237filebrowser through 2.63.23 Stale Share Link via File Rename
- CVE-2026-82236File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
- CVE-2026-82235filebrowser through 2.63.23 Denial of Service via named pipes
- CVE-2026-62684File Browser: Share API exposes the password hash and bypass token
- CVE-2026-72838FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
- CVE-2026-72837File Browser before 2.63.20 Privilege Escalation via Proxy Authentication
- CVE-2026-72836FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
- CVE-2026-72835filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
- CVE-2026-72834filebrowser before 2.63.19 Permission Bypass via checksum
- CVE-2026-72839filebrowser through 2.63.16 Privilege Escalation via Signup
- CVE-2026-73613filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink
- CVE-2026-73612File Browser before v2.63.22 Authorization Bypass via Recursive Operations
- CVE-2026-73611File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass
- CVE-2026-62685File Browser: Colliding username normalization gives two users the same home directory
- CVE-2026-62843File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
- CVE-2026-62683File Browser: Trailing-slash delete leaves a stale public share behind
- CVE-2026-61874filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
- CVE-2026-55668File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope
- CVE-2026-54090File Browser: Command Allowlist Bypass via Shell Metacharacter Injection
- CVE-2026-54088File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
- CVE-2026-54089File Browser: Authentication Bypass via Proxy Auth Header Forgery
- CVE-2026-54091File Browser: Incorrect access control in public directory shares via rule path rebasing
- CVE-2026-54092File Browser: DoS Vulnerability on Public Login API
- CVE-2026-54097File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix
- CVE-2026-54093File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames