Filebrowser vulnerabilities
We track 32 vulnerabilities in Filebrowser products. 32 are rated high or critical, and none are known to be exploited. The most recent was published on September 14, 2026.
Latest Filebrowser vulnerabilities
- 8.1 High severity
filebrowser: Incorrect Authorization
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go). Unlike the TUS upload handler, the direct-upload handler does not reject a target that is an existing
- 8.8 High severity
filebrowser: Improper Access Control
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users
- 8.1 High severity
filebrowser: Improper Handling of Case Sensitivity
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. When Signup and CreateUserDir are enabled and FileBrowser's root is on a case-insensitive filesystem (confirmed on Win
- 9.8 Critical severity
filebrowser: Incorrect Privilege Assignment
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting. Unauthenticated attackers can register accounts that inherit the server root scope with full create, modify, delete, re
- 8.2 High severity
filebrowser: Improper Link Resolution Before File Access
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files outside their scope. Attackers can swap an
- 8.1 High severity
filebrowser: Authorization Bypass Through User-Controlled Key
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. Attackers can copy, rename, or delete denied files by operating
- 8.1 High severity
filebrowser: Use of Non-Canonical URL Paths for Authorization Decisions
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.17, File Browser builds new user scopes from usernames passed through cleanUsername() when Signup=true and Cr
- 8.2 High severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.16, a scoped, non-admin File Browser user holding only the Create permission can delete arbitrary files outsi
- 7.2 High severity
filebrowser: Authorization Bypass Through User-Controlled Key
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, a low-privileged authenticated user of filebrowser (with create + delete permissions in their own isolated
- 8.4 High severity
filebrowser: Incorrect Authorization
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.7, `POST /api/share/<path>` accepts an authenticated request for an arbitrary path and stores a public share
- 7.5 High severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.14, it does not stop the HTTP file handlers from following symbolic links before they open, serve, write, sha
- 7.5 High severity
filebrowser: Incorrect Authorization
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, File Browser's public share handlers rebase the share owner's filesystem root to the shared directory and
- 8.7 High severity
filebrowser: Improper Neutralization of Special Elements used in a Command
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured (e.g. /bin/sh -c), the command allowlist can be bypassed through sh
- 9.1 Critical severity
filebrowser: Improper Authentication
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Starting with 2.0.0-rc.1, when FileBrowser is configured with proxy authentication (auth.method=proxy), any unauthenticated
- 9.3 Critical severity
filebrowser: Improper Neutralization of Special Elements used in an OS Command
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an
- 8.8 High severity
filebrowser: Improper Privilege Management
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission an
- 7.5 High severity
filebrowser: Missing Authorization
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Downlo
- 7.5 High severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator w
- 8.1 High severity
filebrowser: Incorrect Authorization
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user r
- 7.2 High severity
filebrowser: Improper Neutralization of Special Elements used in an OS Command
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file even
- 9.0 Critical severity
filebrowser: Improper Neutralization of Input During Web Page Generation
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scripting (XSS). Java
- 9.8 Critical severity
filebrowser: Improper Privilege Management
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(u
- 9.8 Critical severity
filebrowser: Improper Privilege Management
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and below, any unauthenticated visitor can register a full administrator account when self-registration
- 8.1 High severity
filebrowser: Integer Overflow or Wraparound
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x branch prior to 2.33.8, the TUS resumable upload handler parses the Upload-Length header as a signed
- 8.1 High severity
filebrowser: Improper Access Control
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authent
- 8.1 High severity
filebrowser: Incorrect Authorization
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the r
- 8.8 High severity
filebrowser: Authorization Bypass Through User-Controlled Key
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference (IDOR) vulnerability in the FileBrowser applica
- 9.8 Critical severity
filebrowser: Authentication Bypass by Primary Weakness
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even afte
- 7.5 High severity
filebrowser: Improper Restriction of Excessive Authentication Attempts
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process in
- 8.0 High severity
filebrowser: Improper Neutralization of Special Elements used in a Command
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access
- 8.0 High severity
filebrowser: Improper Neutralization of Special Elements used in a Command
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the exe
- 9.0 Critical severity
Filebrowser: Improper Neutralization of Input During Web Page Generation
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.