GO-2024-2698 vulnerabilities

Vulnerabilities for packages: vault, wolfictl, gotenberg, kots, k9s, kubescape, zarf, filebrowser, terragrunt, chainctl, nuclei...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: grype, filebrowser, grype-db, cg, nuclei, trufflehog-fips, mattermost-fips, chezmoi, gotenberg, kots, k9s, mattermost, gitleaks, wolfictl, syft, grype-fips, gptscript, undock, k9s-fips, syft-fips, kubescape, zarf, trufflehog, chainctl...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: filebrowser, hugo-extended, rclone, seaweedfs, mattermost, mailpit, hugo...

GO-2026-4474 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-5481 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: gitness, undock, opentofu, grafana-alloy, trivy-operator, k9s, envoy-gateway, steampipe, nsc, trivy, zot, tflint, guac, nuclei, rancher-fleet, vcluster, kubescape-operator, gitleaks, trufflehog, filebrowser, xeol, zarf, terragrunt, gptscript, podman, terraform...

GO-2026-4344 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3790 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2024-2698 vulnerabilities

Vulnerabilities for packages: filebrowser, zarf, kots, terragrunt, nuclei, wolfictl, kubescape, k9s...

GO-2025-3792 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3811 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3605 vulnerabilities

Vulnerabilities for packages: filebrowser, kots...

GO-2025-3793 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: filebrowser, zarf, kots, k9s, syft, undock, gptscript, nuclei, trufflehog, wolfictl, kubescape, chezmoi, gitleaks, grype...

CVE-2026-72835: Improper Resolution of Path Equivalence

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

PT-2026-72004

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72838: Allocation of Resources Without Limits or Throttling

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72836: Improper Handling of Case Sensitivity

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72834: Exposure of Sensitive Information to an Unauthorized Actor

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...