{"id":"GHSA-6jqf-mv7m-3q7p","aliases":["GO-2025-4118"],"status":"published","title":"File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency","description":"The standard library `net/http` package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.\n\nSee https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395"],"published":"2025-11-13T22:36:01Z","modified":"2026-03-03T04:57:36Z","fixes":[{"ecosystem":"Go","package":"github.com/filebrowser/filebrowser/v2","fixed_in":["2.45.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.45.1"},{"fixed":"2.45.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.45.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/filebrowser/filebrowser","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.45.2"}]}]}],"references":[{"url":"https://github.com/filebrowser/filebrowser/security/advisories/GHSA-6jqf-mv7m-3q7p","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22871","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-6jqf-mv7m-3q7p"},{"url":"https://github.com/filebrowser/filebrowser","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-6jqf-mv7m-3q7p","title":"File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency","description":"The standard library `net/http` package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.\n\nSee https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.","status":"published","published":"2025-11-13T22:36:01Z","modified":"2025-11-13T22:36:02Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T14:39:08.983925Z"}],"osv":[{"id":"GHSA-6jqf-mv7m-3q7p","title":"File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency","description":"The standard library `net/http` package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.\n\nSee https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.","status":"published","published":"2025-11-13T22:36:01Z","modified":"2025-11-17T21:50:44Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-1395"],"updated_at":"2026-11-02T15:46:39.965326Z"},{"id":"GO-2025-4118","title":"File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser","description":"File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser","status":"published","published":"2025-11-17T19:11:25Z","modified":"2026-03-03T04:57:36.854753Z","updated_at":"2026-11-02T15:47:02.011123Z"}]}}