Vulnerabilities

Filters

Reset all

2 selected

32 records

Sort

Vendor: filebrowser Component: Filebrowser Clear all filters

TI-2026-27710 CVE-2026-35607 · GHSA-7526-j432-6ppp

File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

HIGH 73

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00398 Published 2026-04-07 Fixed in 2.63.1 CWE-269

TI-2026-27709 CVE-2026-35606 · GHSA-67cg-cpj7-qgc9

File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check

MEDIUM 57

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00352 Published 2026-04-07 Fixed in 2.63.1 CWE-862

TI-2026-27708 CVE-2026-35605 · GHSA-5q48-q4fm-g3m6

File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

HIGH 67

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00407 Published 2026-04-07 Fixed in 2.63.1 CWE-22

TI-2026-27707 CVE-2026-35604 · GHSA-v9w4-gm2x-6rvf

File Browser share links remain accessible after Share/Download permissions are revoked

HIGH 69

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00345 Published 2026-04-07 Fixed in 2.63.1 CWE-863

TI-2026-27688 CVE-2026-35585 · GHSA-jvpw-637p-h3pw

File Browser has a Command Injection via Hook Runner

HIGH 68

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.01997 Published 2026-04-07 Fixed in 2.33.8 CWE-78

TI-2026-26779 CVE-2026-34530 · GHSA-xfqj-3vmx-63wv

File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

MEDIUM 64

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1MEDIUM 6.9 Network High privileges User interaction EPSS 0.0037 Published 2026-04-01 Fixed in 2.62.2 CWE-79

TI-2026-26777 CVE-2026-34528 · GHSA-x8jc-jvqm-pm3f

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

HIGH 76

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0068 Published 2026-04-01 Fixed in 2.62.2 CWE-269

TI-2026-26778 CVE-2026-34529 · GHSA-5vpr-4fgw-f69h

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

HIGH 72

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.00327 Published 2026-04-01 Fixed in 2.62.2 CWE-79

TI-2026-25252 CVE-2026-32761 · GHSA-68j5-4m99-w9w9

File Browser has an Authorization Policy Bypass in its Public Share Download Flow

MEDIUM 62

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00441 Published 2026-03-19 Fixed in 2.62.0 CWE-284

TI-2026-25251 CVE-2026-32760 · GHSA-5gg9-5g7w-hm73

File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin

HIGH 82

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00695 Published 2026-03-19 Fixed in 2.62.0 CWE-269

TI-2026-25250 CVE-2026-32759 · GHSA-ffx7-75gc-jg7c

File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely

LOW 28

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.01979 Published 2026-03-19 Fixed in 2.33.8 CWE-190

TI-2026-25249 CVE-2026-32758 · GHSA-9f3r-2vgw-m8xp

File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

MEDIUM 62

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00403 Published 2026-03-19 Fixed in 2.62.0 CWE-22

TI-2026-23759 CVE-2026-30934 · GHSA-r633-fcgp-m532

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

HIGH 74

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00413 Published 2026-03-10 Fixed in 1.3.1-beta, 1.2.2-stable +1 CWE-79

TI-2026-23758 CVE-2026-30933 · GHSA-525j-95gf-766f

FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

HIGH 72

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-03-10 Fixed in 1.3.1-beta, 1.2.2-stable +1 CWE-200

TI-2026-22755 CVE-2026-28492 · GHSA-mr74-928f-rw69

File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory

HIGH 70

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00374 Published 2026-03-05 Fixed in 2.61.0 CWE-200

TI-2026-23305 CVE-2026-29188 · GHSA-79pf-vx4x-7jmm

File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

HIGH 78

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00537 Published 2026-03-05 Fixed in 2.61.1 CWE-284

TI-2026-20929 CVE-2026-25890 · GHSA-4mh3-h929-w968

File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

LOW 38

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00501 Published 2026-02-09 Fixed in 2.57.2, 2.57.1 CWE-706

TI-2026-20928 CVE-2026-25889 · GHSA-hxw8-4h9j-hq2r

File Browser has an Authentication Bypass in User Password Update

LOW 24

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00361 Published 2026-02-09 Fixed in 2.57.1 CWE-178

TI-2026-19212 CVE-2026-23849 · GHSA-43mm-m3h2-3prc

File Browser vulnerable to Username Enumeration via Timing Attack in /api/login

LOW 31

File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00478 Published 2026-01-19 Fixed in 2.55.0 CWE-208

TI-2025-39913 CVE-2025-64523 · GHSA-6cqf-cfhv-659g

FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

HIGH 65

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00461 Published 2025-11-12 Fixed in 2.45.1 CWE-285

TI-2025-33718 CVE-2025-53826 · GHSA-7xwp-2cpp-p8r7

FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

HIGH 73

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00552 Published 2025-07-15 No fix listed CWE-305

TI-2025-33768 CVE-2025-53893 · GHSA-7xqm-7738-642x

File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing

HIGH 73

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00406 Published 2025-07-15 No fix listed CWE-400

TI-2025-33002 CVE-2025-52997 · GHSA-cm2r-rg7r-p7gg

File Browser Insecurely Handles Passwords

HIGH 66

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0054 Published 2025-06-30 Fixed in 2.34.1 CWE-1392

TI-2025-33001 CVE-2025-52996 · GHSA-3v48-283x-f2w4

File Browser's Password Protection of Links Vulnerable to Bypass

MEDIUM 53

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00389 Published 2025-06-30 No fix listed CWE-305

TI-2025-33000 CVE-2025-52995 · GHSA-w7qc-6grj-w7r8

File Browser vulnerable to command execution allowlist bypass

HIGH 76

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.00635 Published 2025-06-30 Fixed in 2.33.10 CWE-77