340 matches found
CVE-2026-61874
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...
CVE-2026-61874
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...
EUVD-2026-43234
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...
CVE-2026-61874 filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...
CVE-2026-61874 filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...
CVE-2026-61874
CVE-2026-61874 affects filebrowser before 2.63.17. The root cause is improper path normalization in DeleteWithPathPrefix, allowing an authenticated user to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path and then recreate the same directory to...
CVE-2026-61874 filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose ne...
GHSA-XQP3-JQ6G-X3QM File Browser: Authentication Bypass via Proxy Auth Header Forgery
Summary When FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a...
File Browser: Authentication Bypass via Proxy Auth Header Forgery
Summary When FileBrowser is configured with proxy authentication auth.method=proxy, any unauthenticated attacker who can reach the server directly can impersonate any user - including admin - by sending a single forged HTTP header. No credentials are required. Additionally, specifying a...
CVE-2026-54685
creationtimestamp| type| source ---|---|--- 2026-07-08 18:35:05+00:00| published-proof-of-concept| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w...
CVE-2026-46602 vulnerabilities
Vulnerabilities for packages: seaweedfs-fips, filebrowser, rclone, hugo, hugo-extended, seaweedfs-rocksdb-fips, listmonk, seaweedfs, mattermost-fips, hugo-fips, mailpit, seaweedfs-rocksdb, seaweedfs-operator, mattermost, gitlab-workhorse-ce, rclone-fips, seaweedfs-operator-fips, mailpit-fips...
GHSA-PWFV-328H-75X9 vulnerabilities
Vulnerabilities for packages: seaweedfs-fips, filebrowser, rclone, hugo, hugo-extended, seaweedfs-rocksdb-fips, listmonk, seaweedfs, mattermost-fips, hugo-fips, mailpit, seaweedfs-rocksdb, seaweedfs-operator, mattermost, gitlab-workhorse-ce, rclone-fips, seaweedfs-operator-fips, mailpit-fips...
CVE-2026-46602 vulnerabilities
Vulnerabilities for packages: hugo-extended, mattermost, hugo, seaweedfs, filebrowser, mailpit, rclone...
GHSA-PWFV-328H-75X9 vulnerabilities
Vulnerabilities for packages: hugo-extended, mattermost, hugo, seaweedfs, filebrowser, mailpit, rclone...
GO-2026-5776 FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks in github.com/gtsteffaniak/filebrowser
FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks in github.com/gtsteffaniak/filebrowser. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...
GO-2026-5511 FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) in github.com/gtsteffaniak/filebrowser
FileBrowser Vulnerable to Stored XSS via SVG File in Public Share Missing CSP Header in github.com/gtsteffaniak/filebrowser...
GO-2026-5591 FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory in github.com/gtsteffaniak/filebrowser/backend
FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory in github.com/gtsteffaniak/filebrowser/backend...
GO-2026-5458 File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser
File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser...
GO-2026-5411 File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the Hook Authentication process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into the username or password fields during login. Remediation Upgrade...