THREATIST.IORead the docs 65 records
File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the target, allowing authenticated users to bypass deny rules.
File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in http/resource.go).
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits.
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages.
filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests.
filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup).
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file.
filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk.
File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths.
FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration.
filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths.
filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint.
filebrowser through 2.63.16 fails to properly restrict scope and permissions when self-signup is enabled with default CreateUserDir setting.
filebrowser versions before 2.63.19 contain an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism that allows authenticated users with only Create permission to delete arbitrary files out…
File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls.
File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
filebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind.
File Browser provides a web file managing interface.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory.