GO-2024-2698 vulnerabilities

Vulnerabilities for packages: terragrunt, kots, kubescape, gotenberg, nuclei, wolfictl, chainctl, filebrowser, zarf, k9s, vault...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: k9s-fips, syft, syft-fips, chezmoi, undock, mattermost, k9s, grype-fips, trufflehog-fips, gotenberg, chainctl, grype-db, trufflehog, filebrowser, grype, gptscript, zarf, kots, kubescape, nuclei, wolfictl, cg, gitleaks, mattermost-fips...

GO-2026-5062 vulnerabilities

Vulnerabilities for packages: filebrowser, mailpit, hugo-extended, seaweedfs, rclone, hugo, mattermost...

GO-2026-4474 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2026-5481 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3922 vulnerabilities

Vulnerabilities for packages: vcluster, zot, rancher-fleet, terragrunt, gptscript, trivy, terraform, filebrowser, xeol, undock, nuclei, zarf, k9s, gitleaks, trivy-operator, nsc, envoy-gateway, opentofu, tflint, grafana-alloy, podman, guac, kubescape-operator, gitness, steampipe, trufflehog...

GO-2025-3790 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2024-2698 vulnerabilities

Vulnerabilities for packages: k9s, filebrowser, kubescape, terragrunt, zarf, wolfictl, nuclei, kots...

GO-2026-4344 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3792 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3605 vulnerabilities

Vulnerabilities for packages: filebrowser, kots...

GO-2025-3811 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-3793 vulnerabilities

Vulnerabilities for packages: filebrowser...

GO-2025-4020 vulnerabilities

Vulnerabilities for packages: filebrowser, k9s, kubescape, syft, gitleaks, chezmoi, gptscript, zarf, trufflehog, wolfictl, undock, nuclei, kots, grype...

PT-2026-72004

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72835: Improper Resolution of Path Equivalence

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72838: Allocation of Resources Without Limits or Throttling

FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk spa...

CVE-2026-72836: Improper Handling of Case Sensitivity

FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem confirmed on Windows/NTFS, two self-registered usernam...

CVE-2026-72834: Exposure of Sensitive Information to an Unauthorized Actor

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...

PT-2026-72005

Name of the Vulnerable Software and Affected Versions FileBrowser versions prior to 2.63.19 Description An issue exists when the software is hosted on a case-insensitive filesystem, such as Windows/NTFS, and both Signup and CreateUserDir are enabled. The system fails to account for...