# filebrowser.

Every CVE that names filebrowser among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first

- [File Browser through 2.63.23 Path Traversal via Symlink Alias](https://agentprime.io/advisories/CVE-2026-90930.md)
  `CVE-2026-90930` · CVE record: filebrowser filebrowser · CVSS 7.6 High · Not analysed yet · Published 14 Sept 2026 · Tags: Path traversal
- [File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup](https://agentprime.io/advisories/CVE-2026-90929.md)
  `CVE-2026-90929` · CVE record: filebrowser filebrowser · CVSS 7.2 High · Not analysed yet · Published 14 Sept 2026 · Tags: Broken access control
- [File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint](https://agentprime.io/advisories/CVE-2026-90928.md)
  `CVE-2026-90928` · CVE record: filebrowser filebrowser · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message](https://agentprime.io/advisories/CVE-2026-90927.md)
  `CVE-2026-90927` · CVE record: filebrowser filebrowser · CVSS 7.1 High · Not analysed yet · Published 14 Sept 2026 · Tags: Denial of service
- [filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads](https://agentprime.io/advisories/CVE-2026-82238.md)
  `CVE-2026-82238` · CVE record: filebrowser filebrowser · CVSS 2.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: Race condition
- [filebrowser through 2.63.23 Stale Share Link via File Rename](https://agentprime.io/advisories/CVE-2026-82237.md)
  `CVE-2026-82237` · CVE record: filebrowser filebrowser · CVSS 2.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-459
- [File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion](https://agentprime.io/advisories/CVE-2026-82236.md)
  `CVE-2026-82236` · CVE record: filebrowser filebrowser · CVSS 2.3 Low · Not analysed yet · Published 28 Aug 2026 · Tags: CWE-459
- [filebrowser through 2.63.23 Denial of Service via named pipes](https://agentprime.io/advisories/CVE-2026-82235.md)
  `CVE-2026-82235` · CVE record: filebrowser filebrowser · CVSS 8.2 High · Not analysed yet · Published 28 Aug 2026 · Tags: Denial of service
- [FileBrowser before 2.63.19 Disk Exhaustion via TUS Upload](https://agentprime.io/advisories/CVE-2026-72838.md)
  `CVE-2026-72838` · CVE record: filebrowser filebrowser · CVSS 7.1 High · Not analysed yet · Published 14 Aug 2026 · Tags: Denial of service
- [File Browser before 2.63.20 Privilege Escalation via Proxy Authentication](https://agentprime.io/advisories/CVE-2026-72837.md)
  `CVE-2026-72837` · CVE record: filebrowser filebrowser · CVSS 8.7 High · Not analysed yet · Published 14 Aug 2026 · Tags: Broken access control
- [FileBrowser before 2.63.19 Case Sensitivity Authentication Bypass](https://agentprime.io/advisories/CVE-2026-72836.md)
  `CVE-2026-72836` · CVE record: filebrowser filebrowser · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-178
- [filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization](https://agentprime.io/advisories/CVE-2026-72835.md)
  `CVE-2026-72835` · CVE record: filebrowser filebrowser · CVSS 7.6 High · Not analysed yet · Published 14 Aug 2026 · Tags: CWE-41
- [filebrowser before 2.63.19 Permission Bypass via checksum](https://agentprime.io/advisories/CVE-2026-72834.md)
  `CVE-2026-72834` · CVE record: filebrowser filebrowser · CVSS 5.3 Medium · Not analysed yet · Published 14 Aug 2026 · Tags: Information disclosure
- [filebrowser through 2.63.16 Privilege Escalation via Signup](https://agentprime.io/advisories/CVE-2026-72839.md)
  `CVE-2026-72839` · CVE record: filebrowser filebrowser · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Aug 2026 · Tags: Privilege escalation
- [filebrowser before 2.63.19 Out-of-Scope File Deletion via Symlink](https://agentprime.io/advisories/CVE-2026-73613.md)
  `CVE-2026-73613` · CVE record: filebrowser filebrowser · CVSS 7.2 High · Not analysed yet · Published 13 Aug 2026 · Tags: Path traversal
- [File Browser before v2.63.22 Authorization Bypass via Recursive Operations](https://agentprime.io/advisories/CVE-2026-73612.md)
  `CVE-2026-73612` · CVE record: filebrowser filebrowser · CVSS 8.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Broken access control
- [File Browser 2.50.0 through 2.63.21 JWT Expiration Bypass](https://agentprime.io/advisories/CVE-2026-73611.md)
  `CVE-2026-73611` · CVE record: filebrowser filebrowser · CVSS 7.6 High · Not analysed yet · Published 13 Aug 2026 · Tags: Authentication bypass
- [File Browser: Trailing-slash delete leaves a stale public share behind](https://agentprime.io/advisories/CVE-2026-62683.md)
  `CVE-2026-62683` · CVE record: filebrowser filebrowser · CVSS 3.1 Low · Not analysed yet · Published 15 Jul 2026 · Tags: Broken access control
- [filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete](https://agentprime.io/advisories/CVE-2026-61874.md)
  `CVE-2026-61874` · CVE record: filebrowser filebrowser · CVSS 2.3 Low · Not analysed yet · Published 12 Jul 2026 · Tags: Broken access control

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=filebrowser>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/filebrowser/>. Everything for agents: <https://agentprime.io/llms.txt>.