Skip to content
Threat Feed

Vendor

Filebrowser

5 briefs RSS
critical advisory

Authorization Bypass in File Browser via Recursive Operations

File Browser versions prior to 2.63.22 contain an authorization bypass vulnerability allowing authenticated users to manipulate restricted files via recursive copy, rename, and delete operations.

File Browser +2 vulnerability access-control-bypass cve file-deletion path-traversal
1r 2t 1c updated
high advisory

Path Traversal in FileBrowser Subtitle Handler

An unauthenticated-accessible path traversal vulnerability in FileBrowser's subtitle handler allows authenticated users to read arbitrary files from the host filesystem, leading to potential credential theft and privilege escalation.

filebrowser/backend path-traversal cve-2026-54910 filebrowser
1r 2t 1c
high advisory

FileBrowser Username Normalization Collision Leads to Authorization Bypass

A critical authorization bypass vulnerability, CVE-2026-62685, in FileBrowser versions <= 2.63.16 enables an attacker to gain full read and write access to other users' files by exploiting a username normalization collision during self-registration, thus bypassing per-user isolation and allowing data tampering or exfiltration.

FileBrowser <= 2.63.16 authorization-bypass web-application filebrowser vulnerability
4t 1c
medium advisory

File Browser Symlink Following Vulnerability Allows Out-of-Scope File Deletion (CVE-2026-55667)

A File Browser user with only `Create` permission can exploit CVE-2026-55667, an incomplete fix for CVE-2026-54094, to delete arbitrary files and directories outside their authorized scope by abusing the `ScopedFs.RemoveAll` function's symlink-following behavior during failed upload cleanup, leading to data loss, cross-tenant data deletion, or denial of service.

filebrowser vulnerability file-browser symlink-attack data-loss denial-of-service
2t 2c
high advisory

FileBrowser Authentication Bypass via Forged Proxy Authentication Header

An unauthenticated attacker can impersonate any user, including administrators, or automatically create new user accounts in FileBrowser by forging the `X-Remote-User` HTTP header when the server is configured for proxy authentication and is directly reachable, leading to full administrative control and unauthorized access to data.

FileBrowser authentication-bypass web-vulnerability privilege-escalation file-browser account-creation
1r 3t