399 matches found
CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834
CVE-2026-72834 affects filebrowser before 2.63.19. The /api/resources checksum branch reads the entire file to compute a digest and returns it without performing a Perm.Download check, allowing an authenticated user with Perm.Download=false to obtain a content-hash oracle (md5/sha1/sha256/sha512)...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
EUVD-2026-58648
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
GO-2025-3792 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-4474 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5966 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2025-3793 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5481 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-4344 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2025-3811 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5062 vulnerabilities
Vulnerabilities for packages: gitlab-workhorse-ce, seaweedfs-rocksdb-fips, mailpit-fips, hugo-extended, mattermost, seaweedfs, rclone, rclone-fips, mailpit, listmonk, mattermost-fips, seaweedfs-fips, hugo-fips, seaweedfs-operator-fips, filebrowser, seaweedfs-operator, hugo, seaweedfs-rocksdb...
GO-2025-3790 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2025-3605 vulnerabilities
Vulnerabilities for packages: filebrowser, kots, vault, mattermost-fips...
GO-2024-2698 vulnerabilities
Vulnerabilities for packages: kots, gotenberg, mattermost-fips, terragrunt, zarf, vault, kubescape, chainctl, nuclei, filebrowser, wolfictl, k9s...
GO-2025-4020 vulnerabilities
Vulnerabilities for packages: gitleaks, kots, gptscript, grype-fips, syft, k9s-fips, chezmoi, kubescape, nuclei, trufflehog-fips, k9s, trufflehog, mattermost, undock, zarf, syft-fips, wolfictl, chainctl, grype-db, cg, grype, gotenberg, mattermost-fips, filebrowser...
