Skip to contentGtsteffaniak Filebrowser vulnerabilities
- filebrowserFile Browser TUS Negative Upload-Length Fires Post-Upload Hooks PrematurelyCVE-2026-32759Fix available5.3 Medium
- filebrowserFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)CVE-2026-30934Fix available8.9 High
- filebrowserFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoCVE-2026-30933Fix available7.5 High
- filebrowserFile Browser: TUS Delete Endpoint Bypasses Delete Permission CheckCVE-2026-29188Fix available9.1 Critical
- filebrowserFile Browser: Path Traversal in Public Share Links Exposes Files Outside Shared DirectoryCVE-2026-28492Fix available7.1 High
- gtsteffaniak filebrowser, filebrowser quantum +1 moreFileBrowser Quantum: Password Protection Not Enforced on Shared File LinksCVE-2026-27611Fix available7.1 High
- filebrowserFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLCVE-2026-25890Public exploitFix available8.1 High
- filebrowserFile Browser has an Authentication Bypass in User Password UpdateCVE-2026-25889Fix available5.4 Medium
- filebrowserFile Browser vulnerable to Username Enumeration via Timing Attack in /api/loginCVE-2026-23849Fix available5.3 Medium
- filebrowserFileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion FunctionCVE-2025-64523Fix available7.2 High
- filebrowserFileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after LogoutCVE-2025-538267.7 High
- filebrowserFile Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingCVE-2025-538937.7 High
- filebrowserFile Browser Insecurely Handles PasswordsCVE-2025-52997Fix available5.9 Medium
- filebrowserFile Browser's Password Protection of Links Vulnerable to BypassCVE-2025-529963.1 Low
- filebrowserFile Browser vulnerable to command execution allowlist bypassCVE-2025-52995Fix available8.1 High
- filebrowserFile Browser allows sensitive data to be transferred in URLCVE-2025-52901Fix available4.5 Medium
- filebrowserFile Browser: Command Execution not Limited to ScopeCVE-2025-52904Fix available8.0 High
- filebrowserFile Browser Allows Execution of Shell Commands That Can Spawn Other CommandsCVE-2025-52903Fix available8.0 High
- filebrowserFile Browser has Stored Cross-Site Scripting vulnerabilityCVE-2025-52902Fix available7.6 High
- filebrowserFile Browser has Insecure File PermissionsCVE-2025-52900Fix available5.5 Medium