CVE-2026-90927

filebrowser through 2.63.23 contains a denial-of-service vulnerability in the /api/command handler . The server fails to limit WebSocket message size before performing permission checks, allowing any authenticated user to buffer arbitrarily large messages and exhaust server heap memory. Notably, ...