FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

Summary Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete...

CVE-2026-35585 vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-JVPW-637P-H3PW vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-JVPW-637P-H3PW vulnerabilities

Vulnerabilities for packages: filebrowser...

CVE-2026-35585 vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: extism, goreleaser, kube-fluentd-operator, snyk-cli, docker-cli, crossplane, aws-flb-cloudwatch, flux, policy-controller, istio, eksctl, vault-benchmark, cerbos, nats, redpanda, rancher-fleet, vault-env, dive, rabbitmq-messaging-topology-operator, aactl,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: extism, dfc, docker-machine-driver-harvester, nri-elasticsearch, snyk-cli, nri-kafka, trillian, cortex, speedtest-go, harbor, cadvisor, kubernetes-replicator, redpanda, vault-env, grafana-mimir, kube-logging-operator-custom-runner, aws-nuke, nri-nginx, mattermost, ac...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: goreleaser, descheduler, docker-machine-driver-harvester, kube-fluentd-operator, net-kourier, snyk-cli, crossplane-provider-azure-authorization, sftpgo, docker-cli, crossplane, kyverno-policy-reporter-ui, aws-flb-cloudwatch, verticadb-operator, flux, policy-controlle...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: goreleaser, descheduler, docker-machine-driver-harvester, kube-fluentd-operator, net-kourier, snyk-cli, crossplane-provider-azure-authorization, sftpgo, docker-cli, crossplane, kyverno-policy-reporter-ui, aws-flb-cloudwatch, verticadb-operator, flux, policy-controlle...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, flux, nats-server-fips, azuredisk-csi-fips, seaweedfs-fips, xeol, hubble, newrelic-infrastructure-agent, terraform, jaeger, opa-fips-envoy, flux-operator-fips, kube-conformance, cluster-autoscaler-fips, flux-operator, docker-cli-fips,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: commercial-expanso-edge, flux, nats-server-fips, azuredisk-csi-fips, seaweedfs-fips, xeol, hubble, newrelic-infrastructure-agent, terraform, jaeger, opa-fips-envoy, flux-operator-fips, kube-conformance, cluster-autoscaler-fips, flux-operator, docker-cli-fips,...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the createUser process in auth/proxy.go when proxy authentication is enabled and default settings include non-empty commands. An attacker can gain unauthorized execution capabilities and access to...

CVE-2026-5709

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

EUVD-2026-19550

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

CVE-2026-5709

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

CVE-2026-5709

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

CVE-2026-5709

The CVE-2026-5709 entry describes an unsanitized input issue in the FileBrowser API of AWS Research and Engineering Studio (RES) affecting versions 2024.10 through 2025.12.01. A remote authenticated actor could execute arbitrary commands on the cluster-manager EC2 instance via crafted input when ...

CVE-2026-5709 AWS Research and Engineering Studio (RES) FileBrowser Command Injection

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

CVE-2026-5709 AWS Research and Engineering Studio (RES) FileBrowser Command Injection

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

CVE-2026-5709 AWS Research and Engineering Studio (RES) FileBrowser Command Injection

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...