Gtsteffaniak Filebrowser vulnerabilities

• gtsteffaniak filebrowser FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory CVE-2026-116682 Fix available 8.6 HighOctober 27, 2026
• filebrowser File Browser through 2.63.23 Path Traversal via Symlink Alias CVE-2026-90930 7.6 HighSeptember 14, 2026
• filebrowser File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup CVE-2026-90929 7.2 HighSeptember 14, 2026
• filebrowser File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint CVE-2026-90928 7.1 HighSeptember 14, 2026
• filebrowser filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message CVE-2026-90927 7.1 HighSeptember 14, 2026
• filebrowser filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads CVE-2026-82238 2.3 LowAugust 28, 2026
• filebrowser filebrowser through 2.63.23 Stale Share Link via File Rename CVE-2026-82237 2.3 LowAugust 28, 2026
• filebrowser File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion CVE-2026-82236 2.3 LowAugust 28, 2026
• filebrowser filebrowser through 2.63.23 Denial of Service via named pipes CVE-2026-82235 8.2 HighAugust 28, 2026
• filebrowser FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload CVE-2026-72838 7.1 HighAugust 14, 2026
• filebrowser File Browser before 2.63.20 Privilege Escalation via Proxy Authentication CVE-2026-72837 8.7 HighAugust 14, 2026
• filebrowser FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass CVE-2026-72836 9.2 CriticalAugust 14, 2026
• filebrowser filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization CVE-2026-72835 7.6 HighAugust 14, 2026
• filebrowser filebrowser before 2.63.19 Permission Bypass via checksum CVE-2026-72834 5.3 MediumAugust 14, 2026
• filebrowser filebrowser through 2.63.16 Privilege Escalation via Signup CVE-2026-72839 9.3 CriticalAugust 13, 2026
• filebrowser filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink CVE-2026-73613 7.2 HighAugust 13, 2026
• filebrowser File Browser before v2.63.22 Authorization Bypass via Recursive Operations CVE-2026-73612 8.6 HighAugust 13, 2026
• filebrowser File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass CVE-2026-73611 7.6 HighAugust 13, 2026
• filebrowser File Browser: Share API exposes the password hash and bypass token CVE-2026-62684 Fix available 2.7 LowJuly 20, 2026
• gtsteffaniak filebrowser FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files CVE-2026-54910 Fix available 7.7 HighJuly 20, 2026
• filebrowser File Browser: Colliding username normalization gives two users the same home directory CVE-2026-62685 Fix available 8.1 HighJuly 15, 2026
• filebrowser File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) CVE-2026-62843 Fix available 6.8 MediumJuly 15, 2026
• filebrowser File Browser: Trailing-slash delete leaves a stale public share behind CVE-2026-62683 3.1 LowJuly 12, 2026
• filebrowser filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete CVE-2026-61874 2.3 LowJuly 12, 2026
• filebrowser File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope CVE-2026-55668 Fix available 6.3 MediumJuly 8, 2026
• filebrowser File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) CVE-2026-54088 Public exploitFix available 9.3 CriticalJune 25, 2026
• filebrowser File Browser: Authentication Bypass via Proxy Auth Header Forgery CVE-2026-54089 9.1 CriticalJune 25, 2026
• filebrowser File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup CVE-2026-55667 Fix available 8.2 HighJune 25, 2026
• filebrowser File Browser: Command Allowlist Bypass via Shell Metacharacter Injection CVE-2026-54090 Fix available 8.7 HighJune 12, 2026
• filebrowser File Browser: Incorrect access control in public directory shares via rule path rebasing CVE-2026-54091 Fix available 7.5 HighJune 12, 2026
• filebrowser File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames CVE-2026-54093 Fix available 6.8 MediumJune 12, 2026
• filebrowser File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope CVE-2026-54094 Fix available 7.5 HighJune 12, 2026
• filebrowser File Browser: DoS Vulnerability on Public Login API CVE-2026-54092 Fix available 6.5 MediumJune 12, 2026
• filebrowser File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path CVE-2026-54096 Fix available 8.4 HighJune 12, 2026
• filebrowser File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix CVE-2026-54097 Fix available 7.2 HighJune 12, 2026
• gtsteffaniak filebrowser FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory CVE-2026-48777 Fix available 9.3 CriticalMay 22, 2026
• gtsteffaniak filebrowser FileBrowser Quantum: unauthenticated user share share info CVE-2026-46410 Fix available 8.7 HighMay 19, 2026
• gtsteffaniak filebrowser, filebrowser quantum +1 more FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion CVE-2026-44542 Fix available 9.1 CriticalMay 7, 2026
• filebrowser File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands CVE-2026-35607 Fix available 8.1 HighApril 7, 2026
• filebrowser File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check CVE-2026-35606 Fix available 5.3 MediumApril 7, 2026
• filebrowser File Browser has an access rule bypass via HasPrefix without trailing separator in path matching CVE-2026-35605 Fix available 6.3 MediumApril 7, 2026
• filebrowser File Browser share links remain accessible after Share/Download permissions are revoked CVE-2026-35604 Fix available 8.2 HighApril 7, 2026
• filebrowser File Browser has a Command Injection via Hook Runner CVE-2026-35585 Public exploitFix available 7.5 HighApril 7, 2026
• filebrowser File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection CVE-2026-34530 Fix available 6.9 MediumMarch 31, 2026
• filebrowser File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution CVE-2026-34528 Fix available 8.1 HighMarch 31, 2026
• filebrowser File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file CVE-2026-34529 Fix available 7.6 HighMarch 31, 2026
• gtsteffaniak filebrowser FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel CVE-2026-54685 Fix available 5.3 MediumMarch 24, 2026
• filebrowser File Browser has an Authorization Policy Bypass in its Public Share Download Flow CVE-2026-32761 Fix available 6.5 MediumMarch 18, 2026
• filebrowser File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter CVE-2026-32758 Fix available 6.5 MediumMarch 16, 2026
• filebrowser File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin CVE-2026-32760 Fix available 10.0 CriticalMarch 16, 2026
• Show olderLoading…