Filebrowser vulnerabilities

Products

• Filebrowser 65

Newest

• filebrowser File Browser through 2.63.23 Path Traversal via Symlink Alias CVE-2026-90930 7.6 HighSeptember 14, 2026
• filebrowser File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup CVE-2026-90929 7.2 HighSeptember 14, 2026
• filebrowser File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint CVE-2026-90928 7.1 HighSeptember 14, 2026
• filebrowser filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message CVE-2026-90927 7.1 HighSeptember 14, 2026
• filebrowser filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads CVE-2026-82238 2.3 LowAugust 28, 2026
• filebrowser filebrowser through 2.63.23 Stale Share Link via File Rename CVE-2026-82237 2.3 LowAugust 28, 2026
• filebrowser File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion CVE-2026-82236 2.3 LowAugust 28, 2026
• filebrowser filebrowser through 2.63.23 Denial of Service via named pipes CVE-2026-82235 8.2 HighAugust 28, 2026
• filebrowser FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload CVE-2026-72838 7.1 HighAugust 14, 2026
• filebrowser File Browser before 2.63.20 Privilege Escalation via Proxy Authentication CVE-2026-72837 8.7 HighAugust 14, 2026
• filebrowser FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass CVE-2026-72836 9.2 CriticalAugust 14, 2026
• filebrowser filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization CVE-2026-72835 7.6 HighAugust 14, 2026
• filebrowser filebrowser before 2.63.19 Permission Bypass via checksum CVE-2026-72834 5.3 MediumAugust 14, 2026
• filebrowser filebrowser through 2.63.16 Privilege Escalation via Signup CVE-2026-72839 9.3 CriticalAugust 13, 2026
• filebrowser filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink CVE-2026-73613 7.2 HighAugust 13, 2026
• filebrowser File Browser before v2.63.22 Authorization Bypass via Recursive Operations CVE-2026-73612 8.6 HighAugust 13, 2026
• filebrowser File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass CVE-2026-73611 7.6 HighAugust 13, 2026
• filebrowser File Browser: Share API exposes the password hash and bypass token CVE-2026-62684 Fix available 2.7 LowJuly 20, 2026
• filebrowser File Browser: Colliding username normalization gives two users the same home directory CVE-2026-62685 Fix available 8.1 HighJuly 15, 2026
• filebrowser File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) CVE-2026-62843 Fix available 6.8 MediumJuly 15, 2026
• filebrowser File Browser: Trailing-slash delete leaves a stale public share behind CVE-2026-62683 3.1 LowJuly 12, 2026
• filebrowser filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete CVE-2026-61874 2.3 LowJuly 12, 2026
• filebrowser File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope CVE-2026-55668 Fix available 6.3 MediumJuly 8, 2026
• filebrowser File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVE-2026-54088 Public exploitFix available 9.3 CriticalJune 25, 2026
• filebrowser File Browser: Authentication Bypass via Proxy Auth Header Forgery CVE-2026-54089 Fix available 9.1 CriticalJune 25, 2026
• filebrowser File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup CVE-2026-55667 Fix available 8.2 HighJune 25, 2026
• filebrowser File Browser: Command Allowlist Bypass via Shell Metacharacter Injection CVE-2026-54090 Fix available 8.7 HighJune 12, 2026
• filebrowser File Browser: Incorrect access control in public directory shares via rule path rebasing CVE-2026-54091 Fix available 7.5 HighJune 12, 2026
• filebrowser File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames CVE-2026-54093 Fix available 6.8 MediumJune 12, 2026
• filebrowser File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope CVE-2026-54094 Fix available 7.5 HighJune 12, 2026
• filebrowser File Browser: DoS Vulnerability on Public Login API CVE-2026-54092 Fix available 6.5 MediumJune 12, 2026
• filebrowser File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path CVE-2026-54096 Fix available 8.4 HighJune 12, 2026
• filebrowser File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix CVE-2026-54097 Fix available 7.2 HighJune 12, 2026
• filebrowser File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands CVE-2026-35607 Fix available 8.1 HighApril 7, 2026
• filebrowser File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check CVE-2026-35606 Fix available 5.3 MediumApril 7, 2026
• filebrowser File Browser has an access rule bypass via HasPrefix without trailing separator in path matching CVE-2026-35605 Fix available 6.3 MediumApril 7, 2026
• filebrowser File Browser share links remain accessible after Share/Download permissions are revoked CVE-2026-35604 Fix available 8.2 HighApril 7, 2026
• filebrowser File Browser has a Command Injection via Hook Runner CVE-2026-35585 Public exploitFix available 7.5 HighApril 7, 2026
• filebrowser File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection CVE-2026-34530 Fix available 6.9 MediumMarch 31, 2026
• filebrowser File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution CVE-2026-34528 Fix available 8.1 HighMarch 31, 2026
• filebrowser File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file CVE-2026-34529 Fix available 7.6 HighMarch 31, 2026
• filebrowser File Browser has an Authorization Policy Bypass in its Public Share Download Flow CVE-2026-32761 Fix available 6.5 MediumMarch 18, 2026
• filebrowser File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter CVE-2026-32758 Fix available 6.5 MediumMarch 16, 2026
• filebrowser File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin CVE-2026-32760 Fix available 10.0 CriticalMarch 16, 2026
• filebrowser File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely CVE-2026-32759 Fix available 5.3 MediumMarch 16, 2026
• filebrowser FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) CVE-2026-30934 Fix available 8.9 HighMarch 9, 2026
• filebrowser FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info CVE-2026-30933 Fix available 7.5 HighMarch 9, 2026
• filebrowser File Browser: TUS Delete Endpoint Bypasses Delete Permission Check CVE-2026-29188 Fix available 9.1 CriticalMarch 4, 2026
• filebrowser File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory CVE-2026-28492 Fix available 7.1 HighMarch 2, 2026
• filebrowser File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL CVE-2026-25890 Public exploitFix available 8.1 HighFebruary 9, 2026
• Show olderLoading…