filebrowser EUVD-2026-67687

Two distinct attack paths exist with different prerequisites. For unauthenticated exploitation: public share links must be enabled in filebrowser's configuration and the shared directory must contain at least one named pipe (FIFO) file - either pre-existing on the host or introduced by an attacker or insider with host filesystem write access. For authenticated exploitation: a valid filebrowser account is required and the user must have access to a directory containing named pipes. In both cases the underlying OS must be Unix/Linux, since named pipes are a POSIX filesystem construct. The CVSS 4.0 AT:P (attack requirements: partial) captures the named-pipe precondition. Exploitation is limited to availability impact only - no data exposure or modification is possible through this vulnerability. Windows deployments are not affected.

The CVSS 4.0 score of 8.2 (AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) reflects high availability impact via network with no confidentiality or integrity consequence. AC:H and AT:P are appropriate - the attack requires named pipes to already exist (or be placeable) within a filebrowser-served directory, which is a specific environmental precondition rather than a universally trivially met condition. PR:N is accurate because the anonymous attack path through public share links requires no authentication. No EPSS data was provided; without it, probability cannot be quantified. The absence of a KEV listing and no reported POC indicate this is not yet under active exploitation, keeping real-world urgency moderate. The primary risk multiplier is public share link exposure: deployments with public shares pointing at directories on general-purpose Linux filesystems (where named pipes can appear or be created) face meaningful DoS risk from unauthenticated attackers. Deployments with public shares disabled or that serve isolated directories without named pipes have substantially lower exposure.

An attacker discovers an internet-exposed filebrowser instance with public share links enabled, pointing to a directory on a Linux host. The attacker (or an insider who can write to the host filesystem) places a named pipe in the shared directory, then sends a high volume of concurrent HTTP requests to the archive download endpoint for that directory. Each request causes the filebrowser server to block a Go goroutine on the FIFO open() call; with enough concurrent requests the goroutine pool is saturated and the server stops accepting new connections, denying service to legitimate users.