What’s Vulnerable › Products

filebrowser vulnerabilities

65 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 63 published in the last 12 months.

Check whether your filebrowser version is affected

Latest filebrowser vulnerabilities

• CVE-2026-90930 — File Browser through 2.63.23 Path Traversal via Symlink Alias (CVSS 6.8)
• CVE-2026-90929 — File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup (CVSS 8.1)
• CVE-2026-90928 — File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint (CVSS 6.5)
• CVE-2026-90927 — filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message (CVSS 6.5)
• CVE-2026-82238 — filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads (CVSS 3.1)
• CVE-2026-82237 — filebrowser through 2.63.23 Stale Share Link via File Rename (CVSS 3.1)
• CVE-2026-82236 — File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion (CVSS 3.1)
• CVE-2026-82235 — filebrowser through 2.63.23 Denial of Service via named pipes (CVSS 5.9)
• CVE-2026-62684 — File Browser: Share API exposes the password hash and bypass token (CVSS 2.7)
• CVE-2026-72838 — FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload (CVSS 6.5)
• CVE-2026-72837 — File Browser before 2.63.20 Privilege Escalation via Proxy Authentication (CVSS 8.8)
• CVE-2026-72836 — FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass (CVSS 8.1)
• CVE-2026-72835 — filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization (CVSS 6.8)
• CVE-2026-72834 — filebrowser before 2.63.19 Permission Bypass via checksum (CVSS 4.3)
• CVE-2026-72839 — filebrowser through 2.63.16 Privilege Escalation via Signup (CVSS 9.8)
• CVE-2026-73613 — filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink (CVSS 8.2)
• CVE-2026-73612 — File Browser before v2.63.22 Authorization Bypass via Recursive Operations (CVSS 8.1)
• CVE-2026-73611 — File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass (CVSS 6.8)
• CVE-2026-62843 — File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) (CVSS 6.8)
• CVE-2026-62685 — File Browser: Colliding username normalization gives two users the same home directory (CVSS 8.1)
• CVE-2026-62683 — File Browser: Trailing-slash delete leaves a stale public share behind (CVSS 3.1)
• CVE-2026-61874 — filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete (CVSS 3.1)
• CVE-2026-55668 — File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope (CVSS 6.3)
• CVE-2026-55667 — File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup (CVSS 8.2)
• CVE-2026-54097 — File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix (CVSS 7.2)