# cve.now: Filebrowser

The newest entries naming Filebrowser as an affected vendor (up to 200), of 61 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-90930](https://cve.now/CVE-2026-90930.md): File Browser through 2.63.23 Path Traversal via Symlink Alias (CVSS 7.6)
- [CVE-2026-90929](https://cve.now/CVE-2026-90929.md): File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup (CVSS 7.2)
- [CVE-2026-90928](https://cve.now/CVE-2026-90928.md): File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint (CVSS 7.1)
- [CVE-2026-90927](https://cve.now/CVE-2026-90927.md): filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message (CVSS 7.1)
- [CVE-2026-82238](https://cve.now/CVE-2026-82238.md): filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads (CVSS 2.3)
- [CVE-2026-82237](https://cve.now/CVE-2026-82237.md): filebrowser through 2.63.23 Stale Share Link via File Rename (CVSS 2.3)
- [CVE-2026-82236](https://cve.now/CVE-2026-82236.md): File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion (CVSS 2.3)
- [CVE-2026-82235](https://cve.now/CVE-2026-82235.md): filebrowser through 2.63.23 Denial of Service via named pipes (CVSS 8.2)
- [CVE-2026-62684](https://cve.now/CVE-2026-62684.md): File Browser: Share API exposes the password hash and bypass token (CVSS 2.7)
- [CVE-2026-72838](https://cve.now/CVE-2026-72838.md): FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload (CVSS 7.1)
- [CVE-2026-72837](https://cve.now/CVE-2026-72837.md): File Browser before 2.63.20 Privilege Escalation via Proxy Authentication (CVSS 8.7)
- [CVE-2026-72836](https://cve.now/CVE-2026-72836.md): FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass (CVSS 9.2)
- [CVE-2026-72835](https://cve.now/CVE-2026-72835.md): filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization (CVSS 7.6)
- [CVE-2026-72834](https://cve.now/CVE-2026-72834.md): filebrowser before 2.63.19 Permission Bypass via checksum (CVSS 5.3)
- [CVE-2026-72839](https://cve.now/CVE-2026-72839.md): filebrowser through 2.63.16 Privilege Escalation via Signup (CVSS 9.3)
- [CVE-2026-73613](https://cve.now/CVE-2026-73613.md): filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink (CVSS 7.2)
- [CVE-2026-73612](https://cve.now/CVE-2026-73612.md): File Browser before v2.63.22 Authorization Bypass via Recursive Operations (CVSS 8.6)
- [CVE-2026-73611](https://cve.now/CVE-2026-73611.md): File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass (CVSS 7.6)
- [CVE-2026-62685](https://cve.now/CVE-2026-62685.md): File Browser: Colliding username normalization gives two users the same home directory (CVSS 8.1)
- [CVE-2026-62843](https://cve.now/CVE-2026-62843.md): File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) (CVSS 6.8)
- [CVE-2026-62683](https://cve.now/CVE-2026-62683.md): File Browser: Trailing-slash delete leaves a stale public share behind (CVSS 3.1)
- [CVE-2026-61874](https://cve.now/CVE-2026-61874.md): filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete (CVSS 2.3)
- [CVE-2026-55668](https://cve.now/CVE-2026-55668.md): File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope (CVSS 6.3)
- [CVE-2026-54090](https://cve.now/CVE-2026-54090.md): File Browser: Command Allowlist Bypass via Shell Metacharacter Injection (CVSS 8.7)
- [CVE-2026-54088](https://cve.now/CVE-2026-54088.md): File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) (CVSS 9.3)
- [CVE-2026-54089](https://cve.now/CVE-2026-54089.md): File Browser: Authentication Bypass via Proxy Auth Header Forgery (CVSS 9.1)
- [CVE-2026-54091](https://cve.now/CVE-2026-54091.md): File Browser: Incorrect access control in public directory shares via rule path rebasing (CVSS 7.5)
- [CVE-2026-54092](https://cve.now/CVE-2026-54092.md): File Browser: DoS Vulnerability on Public Login API (CVSS 6.5)
- [CVE-2026-54097](https://cve.now/CVE-2026-54097.md): File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix (CVSS 7.2)
- [CVE-2026-54093](https://cve.now/CVE-2026-54093.md): File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames (CVSS 6.8)
- [CVE-2026-54094](https://cve.now/CVE-2026-54094.md): File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope (CVSS 7.5)
- [CVE-2026-54096](https://cve.now/CVE-2026-54096.md): File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path (CVSS 8.4)
- [CVE-2026-55667](https://cve.now/CVE-2026-55667.md): File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup (CVSS 8.2)
- [CVE-2026-35607](https://cve.now/CVE-2026-35607.md): File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands (CVSS 8.1)
- [CVE-2026-35606](https://cve.now/CVE-2026-35606.md): File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check (CVSS 5.3)
- [CVE-2026-35605](https://cve.now/CVE-2026-35605.md): File Browser has an access rule bypass via HasPrefix without trailing separator in path matching (CVSS 6.3)
- [CVE-2026-35604](https://cve.now/CVE-2026-35604.md): File Browser share links remain accessible after Share/Download permissions are revoked (CVSS 8.2)
- [CVE-2026-35585](https://cve.now/CVE-2026-35585.md): File Browser has a Command Injection via Hook Runner (CVSS 7.5)
- [CVE-2026-34530](https://cve.now/CVE-2026-34530.md): File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection (CVSS 6.9)
- [CVE-2026-34528](https://cve.now/CVE-2026-34528.md): File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution (CVSS 8.1)
- [CVE-2026-34529](https://cve.now/CVE-2026-34529.md): File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file (CVSS 7.6)
- [CVE-2026-32761](https://cve.now/CVE-2026-32761.md): File Browser has an Authorization Policy Bypass in its Public Share Download Flow (CVSS 6.5)
- [CVE-2026-32760](https://cve.now/CVE-2026-32760.md): File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin (CVSS 10.0)
- [CVE-2026-32759](https://cve.now/CVE-2026-32759.md): File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely (CVSS 5.3)
- [CVE-2026-32758](https://cve.now/CVE-2026-32758.md): File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter (CVSS 6.5)
- [CVE-2026-28492](https://cve.now/CVE-2026-28492.md): File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory (CVSS 7.1)
- [CVE-2026-29188](https://cve.now/CVE-2026-29188.md): File Browser: TUS Delete Endpoint Bypasses Delete Permission Check (CVSS 9.1)
- [CVE-2026-25890](https://cve.now/CVE-2026-25890.md): File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL (CVSS 8.1)
- [CVE-2026-25889](https://cve.now/CVE-2026-25889.md): File Browser has an Authentication Bypass in User Password Update (CVSS 5.4)
- [CVE-2026-23849](https://cve.now/CVE-2026-23849.md): File Browser vulnerable to Username Enumeration via Timing Attack in /api/login (CVSS 5.3)
- [CVE-2025-64523](https://cve.now/CVE-2025-64523.md): FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function (CVSS 7.2)
- [CVE-2025-53826](https://cve.now/CVE-2025-53826.md): FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout (CVSS 7.7)
- [CVE-2025-53893](https://cve.now/CVE-2025-53893.md): File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing (CVSS 7.7)
- [CVE-2025-52997](https://cve.now/CVE-2025-52997.md): File Browser Insecurely Handles Passwords (CVSS 5.9)
- [CVE-2025-52996](https://cve.now/CVE-2025-52996.md): File Browser's Password Protection of Links Vulnerable to Bypass (CVSS 3.1)
- [CVE-2025-52995](https://cve.now/CVE-2025-52995.md): File Browser vulnerable to command execution allowlist bypass (CVSS 8.1)
- [CVE-2025-52901](https://cve.now/CVE-2025-52901.md): File Browser allows sensitive data to be transferred in URL (CVSS 4.5)
- [CVE-2025-52904](https://cve.now/CVE-2025-52904.md): File Browser: Command Execution not Limited to Scope (CVSS 8.0)
- [CVE-2025-52903](https://cve.now/CVE-2025-52903.md): File Browser Allows Execution of Shell Commands That Can Spawn Other Commands (CVSS 8.0)
- [CVE-2025-52902](https://cve.now/CVE-2025-52902.md): File Browser has Stored Cross-Site Scripting vulnerability (CVSS 7.6)
- [CVE-2025-52900](https://cve.now/CVE-2025-52900.md): File Browser has Insecure File Permissions (CVSS 5.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/filebrowser
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.