GO-2025-3793 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3790 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: k9s, rancher-fleet, zot, opentofu, gptscript, gitness, terragrunt, guac, kubescape-operator, xeol, podman, trivy-operator, tflint, trivy, envoy-gateway, undock, grafana-alloy, trufflehog, nuclei, steampipe, filebrowser, zarf, terraform, gitleaks, nsc, vcluster...

GO-2026-4344 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3605 vulnerabilities

Vulnerabilities for packages: kots, filebrowser...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: k9s, kots, zarf, grype, undock, gitleaks, nuclei, trufflehog, gptscript, wolfictl, kubescape, chezmoi, syft, filebrowser...

CVE-2026-72838: Allocation of Resources Without Limits or Throttling

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72835: Improper Resolution of Path Equivalence

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72836: Improper Handling of Case Sensitivity

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72834: Exposure of Sensitive Information to an Unauthorized Actor

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

PT-2026-72007

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description Authenticated users can write arbitrary data to disk because the software fails to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint. This allows attackers to send...

PT-2026-72003

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

PT-2026-72004

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...

CVE-2026-72839

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

CVE-2026-72839 filebrowser through 2.63.16 Privilege Escalation via Signup

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

CVE-2026-72839

CVE-2026-72839 affects filebrowser up to version 2.63.16, where self-signup with default CreateUserDir permits accounts to inherit the server root scope with full create, modify, delete, rename, share, and download permissions. This unauthenticated access can reach all files, yielding high confid...

CVE-2026-72839

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

CVE-2026-72839 filebrowser through 2.63.16 Privilege Escalation via Signup

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...

CVE-2026-72839 filebrowser through 2.63.16 Privilege Escalation via Signup

filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, rename, share, and download permissions...