What’s Vulnerable › Vulnerabilities

CVE-2026-90928: File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-14 · updated 2026-09-24
• Weakness: CWE-400

Description

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.

Affected products

• filebrowser: through 2.63.23

References

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-448h-jr2h-3vhp
• https://www.vulncheck.com/advisories/file-browser-through-2.63.23-memory-exhaustion-via-subtitle-endpoint
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-448h-jr2h-3vhp

Get alerted when CVE-2026-90928 or the next vulnerability affects your stack