FI
Product
filebrowser
65
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 8High 26Medium 25Low 6
Watch
Add filebrowser to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-72837 | 8.8 | Aug 14 | File Browser before 2.63.20 Privilege Escalation via Proxy Authentication Affected: before 2.63.20 |
| CVE-2026-35607 | 8.8 | Apr 7 | File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands Affected: < 2.63.1 |
| CVE-2025-64523 | 8.8 | Nov 12 | FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function Affected: < 2.45.1 |
| CVE-2021-46398 | 8.8 | Feb 4 | A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via… Affected: before 2.18.0 |
| CVE-2026-54090 | 8.7 | Jun 25 | File Browser: Command Allowlist Bypass via Shell Metacharacter Injection Affected: < 2.33.8 |
| CVE-2026-54096 | 8.4 | Jun 25 | File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path Affected: < 2.63.7 |
| CVE-2026-73613 | 8.2 | Aug 13 | filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink Affected: before 2.63.19 |
| CVE-2026-55667 | 8.2 | Jun 25 | File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup Affected: < 2.63.16 |
| CVE-2026-90929 | 8.1 | Sep 14 | File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup Affected: 2.5.0 through 2.63.23 |
| CVE-2026-72836 | 8.1 | Aug 14 | FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass Affected: before 2.63.19 |
| CVE-2026-73612 | 8.1 | Aug 13 | File Browser before v2.63.22 Authorization Bypass via Recursive Operations Affected: before 2.63.22 |
| CVE-2026-62685 | 8.1 | Jul 15 | File Browser: Colliding username normalization gives two users the same home directory Affected: < 2.63.17 |
| CVE-2026-35604 | 8.1 | Apr 7 | File Browser share links remain accessible after Share/Download permissions are revoked Affected: < 2.63.1 |
| CVE-2026-32759 | 8.1 | Mar 19 | File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely Affected: < 2.33.8 |
| CVE-2026-29188 | 8.1 | Mar 5 | File Browser: TUS Delete Endpoint Bypasses Delete Permission Check Affected: < 2.61.1 |
| CVE-2026-25890 | 8.1 | Feb 9 | File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL Affected: < 2.57.2 |
| CVE-2025-52904 | 8.0 | Jun 26 | File Browser: Command Execution not Limited to Scope Affected: >= 2.0.0, < 2.33.8 |
| CVE-2025-52903 | 8.0 | Jun 26 | File Browser Allows Execution of Shell Commands That Can Spawn Other Commands Affected: >= 2.0.0, < 2.33.10 |
| CVE-2026-54091 | 7.5 | Jun 25 | File Browser: Incorrect access control in public directory shares via rule path rebasing Affected: < 2.63.6 |
| CVE-2026-54094 | 7.5 | Jun 25 | File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope Affected: < 2.63.14 |
| CVE-2026-35606 | 7.5 | Apr 7 | File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check Affected: < 2.63.1 |
| CVE-2026-35605 | 7.5 | Apr 7 | File Browser has an access rule bypass via HasPrefix without trailing separator in path matching Affected: < 2.63.1 |
| CVE-2026-30933 | 7.5 | Mar 10 | FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info Affected: through 1.2.9; 1.2.1; 1.3.0 |
| CVE-2025-52997 | 7.5 | Jun 30 | File Browser Insecurely Handles Passwords Affected: < 2.34.1 |
| CVE-2026-54097 | 7.2 | Jun 25 | File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix Affected: < 2.63.6 |
| CVE-2026-35585 | 7.2 | Apr 7 | File Browser has a Command Injection via Hook Runner Affected: >= 2.0.0-rc.1, < 2.33.8 |
Showing 26