Filebrowser vulnerabilities
61 CVEs and advisories name Filebrowser as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-54094File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope
- CVE-2026-54096File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path
- CVE-2026-55667File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup
- CVE-2026-35607File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands
- CVE-2026-35606File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check
- CVE-2026-35605File Browser has an access rule bypass via HasPrefix without trailing separator in path matching
- CVE-2026-35604File Browser share links remain accessible after Share/Download permissions are revoked
- CVE-2026-35585File Browser has a Command Injection via Hook Runner
- CVE-2026-34530File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection
- CVE-2026-34528File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution
- CVE-2026-34529File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file
- CVE-2026-32761File Browser has an Authorization Policy Bypass in its Public Share Download Flow
- CVE-2026-32760File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin
- CVE-2026-32759File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely
- CVE-2026-32758File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter
- CVE-2026-28492File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory
- CVE-2026-29188File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2026-25890File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL
- CVE-2026-25889File Browser has an Authentication Bypass in User Password Update
- CVE-2026-23849File Browser vulnerable to Username Enumeration via Timing Attack in /api/login
- CVE-2025-64523FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function
- CVE-2025-53826FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout
- CVE-2025-53893File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing
- CVE-2025-52997File Browser Insecurely Handles Passwords
- CVE-2025-52996File Browser's Password Protection of Links Vulnerable to Bypass
- CVE-2025-52995File Browser vulnerable to command execution allowlist bypass
- CVE-2025-52901File Browser allows sensitive data to be transferred in URL
- CVE-2025-52904File Browser: Command Execution not Limited to Scope
- CVE-2025-52903File Browser Allows Execution of Shell Commands That Can Spawn Other Commands
- CVE-2025-52902File Browser has Stored Cross-Site Scripting vulnerability