EUVD-2026-77445
GHSA-9f2h-f5v4-r5qq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable WebSocket endpoint (AV:N) requires only a low-privilege account (PR:L); no complexity or interaction; purely an availability impact via heap exhaustion.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
AnalysisAI
Heap memory exhaustion in filebrowser through 2.63.23 allows any authenticated user to crash the server by sending arbitrarily large WebSocket messages to the /api/command endpoint. The server buffers incoming WebSocket frames before performing permission checks, meaning the DoS path is reachable regardless of whether the EnableExec setting is active or the user holds Execute permission - conditions administrators typically rely on to restrict command access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated filebrowser account (PR:L per CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) scores 7.1 (High), reflecting a network-accessible, low-complexity attack requiring only a valid user account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade filebrowser to a version beyond 2.63.23, per GitHub advisory GHSA-39cx-23x9-5c8p (https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: confirm your filebrowser version and immediately restrict application access to only essential users; implement network-level access controls or firewall rules limiting who can reach the deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today