filebrowser

Records65All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical9CVSS 9.0–10.0

CVSS high34CVSS 7.0–8.9

Exploited now

filebrowser records in CISA KEV

No filebrowser vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Filebrowser 32 records HIGH

Records

32 records in Filebrowser · all components

TI-2026-25251 CVE-2026-32760 · GHSA-5gg9-5g7w-hm73

File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin

HIGH 82

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00695 Published 2026-03-19 Fixed in 2.62.0 CWE-269

TI-2026-23305 CVE-2026-29188 · GHSA-79pf-vx4x-7jmm

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

HIGH 78

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00537 Published 2026-03-05 Fixed in 2.61.1 CWE-284

TI-2026-26777 CVE-2026-34528 · GHSA-x8jc-jvqm-pm3f

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

HIGH 76

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0068 Published 2026-04-01 Fixed in 2.62.2 CWE-269

TI-2025-33000 CVE-2025-52995 · GHSA-w7qc-6grj-w7r8

File Browser vulnerable to command execution allowlist bypass

HIGH 76

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.00635 Published 2025-06-30 Fixed in 2.33.10 CWE-77

TI-2026-23759 CVE-2026-30934 · GHSA-r633-fcgp-m532

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

HIGH 74

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00413 Published 2026-03-10 Fixed in 1.3.1-beta, 1.2.2-stable +1 CWE-79

TI-2023-20699 CVE-2023-39612 · GHSA-pc36-r7r4-c3rv

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an…

HIGH 74

A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administrator via user interaction with a crafted HTML file or URL.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00878 Published 2023-09-16 No fix listed CWE-79

TI-2026-27710 CVE-2026-35607 · GHSA-7526-j432-6ppp

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

HIGH 73

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00398 Published 2026-04-07 Fixed in 2.63.1 CWE-269

TI-2025-33768 CVE-2025-53893 · GHSA-7xqm-7738-642x

File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing

HIGH 73

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00406 Published 2025-07-15 No fix listed CWE-400

TI-2025-33718 CVE-2025-53826 · GHSA-7xwp-2cpp-p8r7

FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

HIGH 73

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00552 Published 2025-07-15 No fix listed CWE-305

TI-2026-26778 CVE-2026-34529 · GHSA-5vpr-4fgw-f69h

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

HIGH 72

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00327 Published 2026-04-01 Fixed in 2.62.2 CWE-79

TI-2026-23758 CVE-2026-30933 · GHSA-525j-95gf-766f

FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

HIGH 72

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-03-10 Fixed in 1.3.1-beta, 1.2.2-stable +1 CWE-200

TI-2026-22755 CVE-2026-28492 · GHSA-mr74-928f-rw69

File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory

HIGH 70

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00374 Published 2026-03-05 Fixed in 2.61.0 CWE-200

TI-2025-32940 CVE-2025-52904 · GHSA-hc8f-m8g5-8362

File Browser: Command Execution not Limited to Scope

HIGH 70

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.01106 Published 2025-06-26 Fixed in 2.33.8 CWE-77

TI-2025-32939 CVE-2025-52903 · GHSA-3q2w-42mv-cph4

File Browser Allows Execution of Shell Commands That Can Spawn Other Commands

HIGH 70

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.01206 Published 2025-06-26 Fixed in 2.33.10 CWE-77

TI-2026-27707 CVE-2026-35604 · GHSA-v9w4-gm2x-6rvf

File Browser share links remain accessible after Share/Download permissions are revoked

HIGH 69

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00345 Published 2026-04-07 Fixed in 2.63.1 CWE-863

TI-2026-27688 CVE-2026-35585 · GHSA-jvpw-637p-h3pw

File Browser has a Command Injection via Hook Runner

HIGH 68

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.01997 Published 2026-04-07 Fixed in 2.33.8 CWE-78

TI-2026-27708 CVE-2026-35605 · GHSA-5q48-q4fm-g3m6

File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

HIGH 67

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00407 Published 2026-04-07 Fixed in 2.63.1 CWE-22

TI-2025-33002 CVE-2025-52997 · GHSA-cm2r-rg7r-p7gg

File Browser Insecurely Handles Passwords

HIGH 66

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0054 Published 2025-06-30 Fixed in 2.34.1 CWE-1392

TI-2025-32938 CVE-2025-52902 · GHSA-4wx8-5gm2-2j97

File Browser has Stored Cross-Site Scripting vulnerability

HIGH 66

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.00334 Published 2025-06-26 Fixed in 2.33.7 CWE-79

TI-2025-39913 CVE-2025-64523 · GHSA-6cqf-cfhv-659g

FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

HIGH 65

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00461 Published 2025-11-12 Fixed in 2.45.1 CWE-285

TI-2026-26779 CVE-2026-34530 · GHSA-xfqj-3vmx-63wv

File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

MEDIUM 64

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0037 Published 2026-04-01 Fixed in 2.62.2 CWE-79

TI-2026-25252 CVE-2026-32761 · GHSA-68j5-4m99-w9w9

File Browser has an Authorization Policy Bypass in its Public Share Download Flow

MEDIUM 62

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00441 Published 2026-03-19 Fixed in 2.62.0 CWE-284

TI-2026-25249 CVE-2026-32758 · GHSA-9f3r-2vgw-m8xp

File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

MEDIUM 62

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00403 Published 2026-03-19 Fixed in 2.62.0 CWE-22

TI-2025-32937 CVE-2025-52901 · GHSA-rmwh-g367-mj4x

File Browser allows sensitive data to be transferred in URL

MEDIUM 62

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00538 Published 2025-06-30 Fixed in 2.33.9 CWE-598

TI-2025-32936 CVE-2025-52900 · GHSA-jj2r-455p-5gvf

File Browser has Insecure File Permissions

MEDIUM 58

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00222 Published 2025-06-26 Fixed in 2.33.7 CWE-276

Open these records in search →