File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

File Browser through 2.63.23 Path Traversal via Symlink Alias

filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

File Browser: Path traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

File Browser vulnerable to command execution allowlist bypass

File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message

FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload

File Browser: DoS Vulnerability on Public Login API

File Browser has an Authorization Policy Bypass in its Public Share Download Flow

File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory

File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing

File Browser allows sensitive data to be transferred in URL

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

filebrowser through 2.63.23 Denial of Service via named pipes

File Browser has Insecure File Permissions

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

File Browser has an Authentication Bypass in User Password Update

File Browser has Stored Cross-Site Scripting vulnerability

File Browser vulnerable to Username Enumeration via Timing Attack in /api/login

filebrowser before 2.63.19 Permission Bypass via checksum

File Browser's Password Protection of Links Vulnerable to Bypass