489 matches found
CVE-2026-72834
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834
CVE-2026-72834 affects filebrowser before 2.63.19. The /api/resources checksum branch reads the entire file to compute a digest and returns it without performing a Perm.Download check, allowing an authenticated user with Perm.Download=false to obtain a content-hash oracle (md5/sha1/sha256/sha512)...
CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
EUVD-2026-58649
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72835
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
EUVD-2026-58648
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...
GO-2025-3793 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-4474 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5966 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2025-3792 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5481 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-4344 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2025-3811 vulnerabilities
Vulnerabilities for packages: filebrowser...
GO-2026-5062 vulnerabilities
Vulnerabilities for packages: hugo-fips, mailpit, mattermost-fips, listmonk, rclone-fips, seaweedfs-rocksdb, gitlab-workhorse-ce, seaweedfs, seaweedfs-operator-fips, seaweedfs-rocksdb-fips, hugo-extended, hugo, filebrowser, mailpit-fips, mattermost, seaweedfs-fips, rclone, seaweedfs-operator...