526 matches found
EUVD-2026-58652
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...
CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...
CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...
CVE-2026-72838 FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...
CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72836
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72836
Affected: FileBrowser before 2.63.19. Root on a case-insensitive filesystem (e.g., Windows/NTFS) allows two self-registered usernames that differ only by case to resolve to the same home directory, because the scope-ownership check uses an exact case-sensitive comparison. This enables an attacker...
CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72836 FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
EUVD-2026-58650
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...
CVE-2026-72835
CVE-2026-72835 affects filebrowser before v2.63.21. The issue is that the application fails to canonicalize paths before evaluating access rules, allowing an authenticated user to bypass administrator-defined deny rules by using case-variant or backslash-separated paths. Attackers can request fil...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
EUVD-2026-58648
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834
CVE-2026-72834 affects filebrowser before 2.63.19. The /api/resources checksum branch reads the entire file to compute a digest and returns it without performing a Perm.Download check, allowing an authenticated user with Perm.Download=false to obtain a content-hash oracle (md5/sha1/sha256/sha512)...
EUVD-2026-58649
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...