Filebrowser
Monthly
Resource exhaustion in filebrowser through 2.63.23 allows denial-of-service by exploiting unvalidated named pipes in the archive and public download handlers. Both authenticated users and anonymous visitors holding public share links can trigger blocking open() syscalls by repeatedly requesting archives that include named pipe (FIFO) filesystem entries, pinning server goroutines until connection resources are exhausted. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the anonymous attack path via public shares elevates the practical concern for internet-exposed deployments.
FileBrowser versions before 2.63.19 fail to enforce the TUS Upload-Length boundary in the PATCH resumable-upload endpoint, enabling authenticated users to stream arbitrarily large request bodies directly to disk regardless of the length declared at upload creation. The root cause, confirmed by the patch diff, is an unbounded io.Copy call that passed r.Body directly to the target file without capping reads to the remaining declared bytes. No public exploit has been identified at time of analysis, and exploitation requires a valid low-privilege account, but the impact - full disk exhaustion causing service unavailability - can be triggered with a single crafted PATCH request.
Improper access control in File Browser before 2.63.20 allows authenticated users operating through proxy or hook authentication to escape their isolated directory scope and access the server root, exposing all other users' files for reading, modification, deletion, and sharing. The flaw specifically targets the createUserDir isolation mechanism, which is bypassed during auto-provisioning in proxy and hook authentication paths - leaving multi-tenant or shared File Browser deployments fully compromised at the data layer. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 score of 8.7 reflects the high impact once a valid upstream credential is obtained.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
Path canonicalization bypass in filebrowser before v2.63.21 permits authenticated users to circumvent administrator-configured deny rules by submitting case-variant or backslash-delimited path representations that the access rule engine fails to normalize before evaluation. The filesystem resolves these alternate representations to the same restricted objects, but the rules engine never matches them, effectively granting access to files the administrator explicitly intended to block. No public exploit code has been identified at time of analysis, though the attack concept is well-understood and straightforward to implement for any authenticated user of an affected deployment.
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delete files outside their authorized scope by abusing a race condition in the TUS resumable upload cache eviction path. An attacker swaps an ancestor directory for a symlink during the cache TTL window, redirecting an unguarded os.Remove() call to an out-of-scope target and completely bypassing ScopedFs scope guards and Perm.Delete permission checks - no Delete permission is required. No public exploit code or CISA KEV listing is identified at time of analysis; the AC:H and AT:P metrics in the CVSS 4.0 vector reflect the timing-dependent nature of the attack.
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename, or delete files they are explicitly denied access to, by initiating the operation on a permitted parent directory. The application's access-rule engine fails to evaluate descendant paths during bulk recursive traversal, defeating the entire isolation model for multi-user deployments. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity.
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy authentication is configured with a non-default logout page, enabling an attacker who possesses any previously valid token to access protected routes and administrative endpoints beyond the token's expiration window. The authentication middleware intentionally waived JWT expiration under proxy-auth - since the proxy is expected to govern session lifetime - but failed to require the proxy to simultaneously assert the user's identity on each request, meaning a leaked or captured token could authenticate independently and indefinitely. No public exploit code has been identified at time of analysis; the fix commit and vendor security advisory are publicly available.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Home-directory hijacking in File Browser before 2.63.17 lets an unauthenticated attacker gain full read/write access to another user's files by registering a username that normalizes to a victim's scope. Because cleanUsername() is a many-to-one transform, distinct usernames such as team/one, team one, and team-one collapse to the same home directory, and the signup path never checked whether the derived scope was already owned. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix commit and a regression test are public, making the root cause well understood.
Pre-authentication remote code execution in File Browser before 2.63.6 lets unauthenticated attackers run arbitrary OS commands when the optional Hook Authentication feature is enabled. Because login credentials are interpolated into an external shell command via os.Expand without sanitization, shell metacharacters placed in the username or password field at the login screen execute on the server before authentication occurs. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-m93h-4hw7-5qcm) confirms the flaw and CVSS 4.0 rates it 9.3 (Critical).
Authentication bypass and privilege escalation in File Browser (versions 2.0.0-rc.1 and later) lets a remote unauthenticated attacker impersonate any account - including admin - by sending a single forged HTTP header when the server runs with proxy authentication (auth.method=proxy). The same flaw doubles as an unauthorized account-creation primitive, since supplying a non-existent username silently provisions a new user. Scored CVSS 9.1 (CWE-287); no public exploit identified at time of analysis, though the underlying behavior has been openly documented for years.
Arbitrary file deletion in File Browser before 2.63.16 lets a scoped, non-admin user holding only the Create permission destroy files outside their assigned scope - including other tenants' data and the application's own database. The flaw lives in the failed-upload cleanup path, where ScopedFs.RemoveAll is the single dereferencing operation that omits the symlink guard enforced everywhere else, so an attacker who plants an escaping directory symlink inside their scope can delete out-of-scope targets while only authenticated as a create-only user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a disclosed-but-not-yet-exploited integrity and availability risk.
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allows holders of a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root by abusing the publicPatchHandler in backend/http/public.go. The flaw stems from filepath.Join collapsing ../ segments BEFORE the SanitizeUserPath check runs, an identical pattern to the previously patched DELETE endpoint (CVE-2026-44542). No public exploit identified at time of analysis, but the GHSA advisory documents the exact code path and the issue is rated CVSS 4.0 9.3 (Critical).
Auto-provisioned users in File Browser's proxy authentication flow inherit elevated execution permissions that were explicitly blocked in the self-registration flow, enabling unauthorized command execution. Versions prior to 2.63.1 grant execute capabilities to proxy-auth users from global defaults, bypassing security controls added in commit b6a4fb1. This affects File Browser instances using proxy authentication for automatic user provisioning. No public exploit identified at time of analysis, though EPSS probability warrants attention given the network-accessible attack surface and high confidentiality/integrity impact.
Authorization bypass in File Browser allows unauthenticated access to shared files after permissions revoked. When administrators revoke a user's Share and Download permissions in File Browser (versions prior to 2.63.1), previously created share links remain accessible to unauthenticated users due to missing permission re-validation in the public share handler. This CWE-863 authorization flaw enables persistent unauthorized data access with high confidentiality impact (CVSS 8.2), though no public exploit or active exploitation (not in CISA KEV) has been identified at time of analysis.
Remote code execution in File Browser versions 2.0.0 through 2.63.1 allows authenticated administrators to execute arbitrary OS commands via malicious filenames. The vulnerability stems from unsanitized variable substitution in the hook system, which processes file events (upload, rename, delete) using administrator-defined shell commands. Attackers with file write permissions can inject shell metacharacters into filenames that trigger command execution when hooks fire. No public exploit identified at time of analysis, though EPSS data not provided. The vulnerable feature has been disabled by default from v2.33.8 onwards as a mitigation measure.
Stored cross-site scripting in FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable allows authenticated attackers to inject malicious scripts through share metadata fields that are improperly rendered without HTML escaping. When victims visit affected share URLs, the injected scripts execute in their browsers with full privileges, potentially leading to session hijacking, credential theft, or further compromise. A patch is available in the fixed versions, though exploitation currently shows 0% adoption likelihood.
FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable leak authentication tokens through the /public/api/share/info endpoint, allowing unauthenticated attackers to bypass password protections on shared files. The vulnerability stems from an incomplete fix to CVE-2026-27611 and enables token disclosure that could facilitate unauthorized file access. No patch is currently available for affected installations.
Unauthorized file operations in File Browser before fix. PoC and patch available.
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictions by injecting multiple slashes into request URLs, enabling unauthorized access to files designated as restricted. The vulnerability exploits a mismatch between the authorization validation logic and filesystem path resolution, affecting users running vulnerable versions. Public exploit code exists for this high-severity issue.
Race condition in filebrowser's TUS resumable upload handler allows authenticated low-privileged users to bypass declared Upload-Length limits by issuing concurrent PATCH requests to the same offset. Affected versions start at 2.24.0. A successful exploit causes files to be written beyond their declared sizes, and may trigger upload completion hooks for oversized payloads - potentially abusing downstream processing logic. No public exploit code or CISA KEV listing exists at time of analysis.
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Authenticated users with Perm.Download=false can extract cryptographic content hashes (MD5, SHA1, SHA256, SHA512) for any file within their scope via filebrowser's /api/resources?checksum= endpoint, bypassing the intended download permission gate. The resourceGetHandler's checksum branch reads entire file content to compute digests but omits the Perm.Download check enforced by all sibling handler paths (raw, preview, subtitle). This is an incomplete remediation of CVE-2026-35606; no public exploit is identified at time of analysis, and the CVSS 4.0 vector (PR:L, VC:L) confirms exploitation requires an authenticated session. The hash oracle enables content confirmation, change detection, and offline brute-force of low-entropy files without ever receiving the file bytes directly.
Username enumeration via authentication timing side-channel in FileBrowser Quantum's `/api/auth/login` endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.
Zip-slip path traversal in File Browser 2.63.6–2.63.16 allows a low-privileged user with upload permission to plant a POSIX backslash-named file that the archive builder incorrectly normalizes into a directory traversal sequence, enabling arbitrary file write on any victim who downloads and extracts the generated archive. The root cause is the server-side conversion of `\` to `/` in archive entry names, which manufactures paths like `../../evil.sh` from the legal POSIX filename `..\..\evil.sh`. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack chain is straightforward for any user with upload access.
File Browser prior to 2.63.17 retains stale public directory share records after a shared directory is deleted via a trailing-slash path, because the Bolt storage backend queries for shares using the unnormalized path before trimming the slash - causing the exact-match share record (stored as '/a') to be missed by a query against '/a/'. If the directory is subsequently recreated at the same path, any holder of the original share URL immediately gains unauthorized read access to the new directory contents. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path normalization failure in filebrowser's DeleteWithPathPrefix function allows authenticated users on versions before 2.63.17 to leave stale public share records intact by deleting directories with trailing-slash paths. After deletion, an attacker can recreate the same directory path and cause its new contents to be silently exposed through the previously dormant, still-valid public share URL. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS 4.0 score of 2.3 reflects the high complexity and limited confidentiality impact.
File Browser versions prior to 2.63.1 allow authenticated users with download permission disabled to bypass access controls and read arbitrary text file content through the resourceGetHandler endpoint in http/resource.go, which fails to validate the Perm.Download permission flag unlike three other content-serving endpoints that correctly enforce this check. This authentication bypass affects any File Browser deployment where users are granted access but restricted from downloading files, and is fixed in version 2.63.1.
File Browser versions prior to 2.63.1 contain a path traversal vulnerability in the Matches() function that fails to enforce directory boundaries when evaluating access control rules. An attacker can bypass intended access restrictions by exploiting the use of strings.HasPrefix() without trailing directory separators, allowing a rule intended to restrict access to /uploads to inadvertently grant or deny access to similarly-named directories such as /uploads_backup/. This affects all File Browser versions before 2.63.1 and requires network access but no authentication or user interaction; no public exploit code or active exploitation has been confirmed at time of analysis.
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public share links, enabling any user with a share link to access and download files from sibling directories beyond the intended shared folder. This authenticated network-based vulnerability affects Golang and Filebrowser and has public exploit code available. The issue is resolved in version 2.61.0 and later.
Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password due to case-sensitive validation logic that can be bypassed using mixed-case field names in API requests. An attacker with a valid JWT token obtained through XSS, session hijacking, or similar means could exploit this to perform account takeover. Public exploit code exists for this vulnerability, and a patch is available.
Filebrowser versions up to 2.55.0 contains a vulnerability that allows attackers to enumerate valid usernames by measuring the response time of the /api/login endpo (CVSS 5.3).
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
CVE-2025-52996 is a security vulnerability (CVSS 3.1). Risk factors: public PoC available.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10.
CVE-2025-52901 is a security vulnerability (CVSS 4.5). Risk factors: public PoC available. Vendor patch is available.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. The fix is tracked on pull request 5199.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Resource exhaustion in filebrowser through 2.63.23 allows denial-of-service by exploiting unvalidated named pipes in the archive and public download handlers. Both authenticated users and anonymous visitors holding public share links can trigger blocking open() syscalls by repeatedly requesting archives that include named pipe (FIFO) filesystem entries, pinning server goroutines until connection resources are exhausted. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the anonymous attack path via public shares elevates the practical concern for internet-exposed deployments.
FileBrowser versions before 2.63.19 fail to enforce the TUS Upload-Length boundary in the PATCH resumable-upload endpoint, enabling authenticated users to stream arbitrarily large request bodies directly to disk regardless of the length declared at upload creation. The root cause, confirmed by the patch diff, is an unbounded io.Copy call that passed r.Body directly to the target file without capping reads to the remaining declared bytes. No public exploit has been identified at time of analysis, and exploitation requires a valid low-privilege account, but the impact - full disk exhaustion causing service unavailability - can be triggered with a single crafted PATCH request.
Improper access control in File Browser before 2.63.20 allows authenticated users operating through proxy or hook authentication to escape their isolated directory scope and access the server root, exposing all other users' files for reading, modification, deletion, and sharing. The flaw specifically targets the createUserDir isolation mechanism, which is bypassed during auto-provisioning in proxy and hook authentication paths - leaving multi-tenant or shared File Browser deployments fully compromised at the data layer. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the CVSS 4.0 score of 8.7 reflects the high impact once a valid upstream credential is obtained.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
Path canonicalization bypass in filebrowser before v2.63.21 permits authenticated users to circumvent administrator-configured deny rules by submitting case-variant or backslash-delimited path representations that the access rule engine fails to normalize before evaluation. The filesystem resolves these alternate representations to the same restricted objects, but the rules engine never matches them, effectively granting access to files the administrator explicitly intended to block. No public exploit code has been identified at time of analysis, though the attack concept is well-understood and straightforward to implement for any authenticated user of an affected deployment.
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delete files outside their authorized scope by abusing a race condition in the TUS resumable upload cache eviction path. An attacker swaps an ancestor directory for a symlink during the cache TTL window, redirecting an unguarded os.Remove() call to an out-of-scope target and completely bypassing ScopedFs scope guards and Perm.Delete permission checks - no Delete permission is required. No public exploit code or CISA KEV listing is identified at time of analysis; the AC:H and AT:P metrics in the CVSS 4.0 vector reflect the timing-dependent nature of the attack.
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename, or delete files they are explicitly denied access to, by initiating the operation on a permitted parent directory. The application's access-rule engine fails to evaluate descendant paths during bulk recursive traversal, defeating the entire isolation model for multi-user deployments. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity.
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy authentication is configured with a non-default logout page, enabling an attacker who possesses any previously valid token to access protected routes and administrative endpoints beyond the token's expiration window. The authentication middleware intentionally waived JWT expiration under proxy-auth - since the proxy is expected to govern session lifetime - but failed to require the proxy to simultaneously assert the user's identity on each request, meaning a leaked or captured token could authenticate independently and indefinitely. No public exploit code has been identified at time of analysis; the fix commit and vendor security advisory are publicly available.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Home-directory hijacking in File Browser before 2.63.17 lets an unauthenticated attacker gain full read/write access to another user's files by registering a username that normalizes to a victim's scope. Because cleanUsername() is a many-to-one transform, distinct usernames such as team/one, team one, and team-one collapse to the same home directory, and the signup path never checked whether the derived scope was already owned. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV, but the fix commit and a regression test are public, making the root cause well understood.
Pre-authentication remote code execution in File Browser before 2.63.6 lets unauthenticated attackers run arbitrary OS commands when the optional Hook Authentication feature is enabled. Because login credentials are interpolated into an external shell command via os.Expand without sanitization, shell metacharacters placed in the username or password field at the login screen execute on the server before authentication occurs. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-m93h-4hw7-5qcm) confirms the flaw and CVSS 4.0 rates it 9.3 (Critical).
Authentication bypass and privilege escalation in File Browser (versions 2.0.0-rc.1 and later) lets a remote unauthenticated attacker impersonate any account - including admin - by sending a single forged HTTP header when the server runs with proxy authentication (auth.method=proxy). The same flaw doubles as an unauthorized account-creation primitive, since supplying a non-existent username silently provisions a new user. Scored CVSS 9.1 (CWE-287); no public exploit identified at time of analysis, though the underlying behavior has been openly documented for years.
Arbitrary file deletion in File Browser before 2.63.16 lets a scoped, non-admin user holding only the Create permission destroy files outside their assigned scope - including other tenants' data and the application's own database. The flaw lives in the failed-upload cleanup path, where ScopedFs.RemoveAll is the single dereferencing operation that omits the symlink guard enforced everywhere else, so an attacker who plants an escaping directory symlink inside their scope can delete out-of-scope targets while only authenticated as a create-only user. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a disclosed-but-not-yet-exploited integrity and availability risk.
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allows holders of a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root by abusing the publicPatchHandler in backend/http/public.go. The flaw stems from filepath.Join collapsing ../ segments BEFORE the SanitizeUserPath check runs, an identical pattern to the previously patched DELETE endpoint (CVE-2026-44542). No public exploit identified at time of analysis, but the GHSA advisory documents the exact code path and the issue is rated CVSS 4.0 9.3 (Critical).
Auto-provisioned users in File Browser's proxy authentication flow inherit elevated execution permissions that were explicitly blocked in the self-registration flow, enabling unauthorized command execution. Versions prior to 2.63.1 grant execute capabilities to proxy-auth users from global defaults, bypassing security controls added in commit b6a4fb1. This affects File Browser instances using proxy authentication for automatic user provisioning. No public exploit identified at time of analysis, though EPSS probability warrants attention given the network-accessible attack surface and high confidentiality/integrity impact.
Authorization bypass in File Browser allows unauthenticated access to shared files after permissions revoked. When administrators revoke a user's Share and Download permissions in File Browser (versions prior to 2.63.1), previously created share links remain accessible to unauthenticated users due to missing permission re-validation in the public share handler. This CWE-863 authorization flaw enables persistent unauthorized data access with high confidentiality impact (CVSS 8.2), though no public exploit or active exploitation (not in CISA KEV) has been identified at time of analysis.
Remote code execution in File Browser versions 2.0.0 through 2.63.1 allows authenticated administrators to execute arbitrary OS commands via malicious filenames. The vulnerability stems from unsanitized variable substitution in the hook system, which processes file events (upload, rename, delete) using administrator-defined shell commands. Attackers with file write permissions can inject shell metacharacters into filenames that trigger command execution when hooks fire. No public exploit identified at time of analysis, though EPSS data not provided. The vulnerable feature has been disabled by default from v2.33.8 onwards as a mitigation measure.
Stored cross-site scripting in FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable allows authenticated attackers to inject malicious scripts through share metadata fields that are improperly rendered without HTML escaping. When victims visit affected share URLs, the injected scripts execute in their browsers with full privileges, potentially leading to session hijacking, credential theft, or further compromise. A patch is available in the fixed versions, though exploitation currently shows 0% adoption likelihood.
FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable leak authentication tokens through the /public/api/share/info endpoint, allowing unauthenticated attackers to bypass password protections on shared files. The vulnerability stems from an incomplete fix to CVE-2026-27611 and enables token disclosure that could facilitate unauthorized file access. No patch is currently available for affected installations.
Unauthorized file operations in File Browser before fix. PoC and patch available.
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictions by injecting multiple slashes into request URLs, enabling unauthorized access to files designated as restricted. The vulnerability exploits a mismatch between the authorization validation logic and filesystem path resolution, affecting users running vulnerable versions. Public exploit code exists for this high-severity issue.
Race condition in filebrowser's TUS resumable upload handler allows authenticated low-privileged users to bypass declared Upload-Length limits by issuing concurrent PATCH requests to the same offset. Affected versions start at 2.24.0. A successful exploit causes files to be written beyond their declared sizes, and may trigger upload completion hooks for oversized payloads - potentially abusing downstream processing logic. No public exploit code or CISA KEV listing exists at time of analysis.
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Authenticated users with Perm.Download=false can extract cryptographic content hashes (MD5, SHA1, SHA256, SHA512) for any file within their scope via filebrowser's /api/resources?checksum= endpoint, bypassing the intended download permission gate. The resourceGetHandler's checksum branch reads entire file content to compute digests but omits the Perm.Download check enforced by all sibling handler paths (raw, preview, subtitle). This is an incomplete remediation of CVE-2026-35606; no public exploit is identified at time of analysis, and the CVSS 4.0 vector (PR:L, VC:L) confirms exploitation requires an authenticated session. The hash oracle enables content confirmation, change detection, and offline brute-force of low-entropy files without ever receiving the file bytes directly.
Username enumeration via authentication timing side-channel in FileBrowser Quantum's `/api/auth/login` endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.
Zip-slip path traversal in File Browser 2.63.6–2.63.16 allows a low-privileged user with upload permission to plant a POSIX backslash-named file that the archive builder incorrectly normalizes into a directory traversal sequence, enabling arbitrary file write on any victim who downloads and extracts the generated archive. The root cause is the server-side conversion of `\` to `/` in archive entry names, which manufactures paths like `../../evil.sh` from the legal POSIX filename `..\..\evil.sh`. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the attack chain is straightforward for any user with upload access.
File Browser prior to 2.63.17 retains stale public directory share records after a shared directory is deleted via a trailing-slash path, because the Bolt storage backend queries for shares using the unnormalized path before trimming the slash - causing the exact-match share record (stored as '/a') to be missed by a query against '/a/'. If the directory is subsequently recreated at the same path, any holder of the original share URL immediately gains unauthorized read access to the new directory contents. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path normalization failure in filebrowser's DeleteWithPathPrefix function allows authenticated users on versions before 2.63.17 to leave stale public share records intact by deleting directories with trailing-slash paths. After deletion, an attacker can recreate the same directory path and cause its new contents to be silently exposed through the previously dormant, still-valid public share URL. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS 4.0 score of 2.3 reflects the high complexity and limited confidentiality impact.
File Browser versions prior to 2.63.1 allow authenticated users with download permission disabled to bypass access controls and read arbitrary text file content through the resourceGetHandler endpoint in http/resource.go, which fails to validate the Perm.Download permission flag unlike three other content-serving endpoints that correctly enforce this check. This authentication bypass affects any File Browser deployment where users are granted access but restricted from downloading files, and is fixed in version 2.63.1.
File Browser versions prior to 2.63.1 contain a path traversal vulnerability in the Matches() function that fails to enforce directory boundaries when evaluating access control rules. An attacker can bypass intended access restrictions by exploiting the use of strings.HasPrefix() without trailing directory separators, allowing a rule intended to restrict access to /uploads to inadvertently grant or deny access to similarly-named directories such as /uploads_backup/. This affects all File Browser versions before 2.63.1 and requires network access but no authentication or user interaction; no public exploit code or active exploitation has been confirmed at time of analysis.
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public share links, enabling any user with a share link to access and download files from sibling directories beyond the intended shared folder. This authenticated network-based vulnerability affects Golang and Filebrowser and has public exploit code available. The issue is resolved in version 2.61.0 and later.
Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password due to case-sensitive validation logic that can be bypassed using mixed-case field names in API requests. An attacker with a valid JWT token obtained through XSS, session hijacking, or similar means could exploit this to perform account takeover. Public exploit code exists for this vulnerability, and a patch is available.
Filebrowser versions up to 2.55.0 contains a vulnerability that allows attackers to enumerate valid usernames by measuring the response time of the /api/login endpo (CVSS 5.3).
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrieve the passwords of all accounts in a given instance. This issue has been patched in version 2.34.1.
CVE-2025-52996 is a security vulnerability (CVSS 3.1). Risk factors: public PoC available.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10.
CVE-2025-52901 is a security vulnerability (CVSS 4.5). Risk factors: public PoC available. Vendor patch is available.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. The fix is tracked on pull request 5199.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Filebrowser module 6.x-2.x before 6.x-2.2 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, related to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.