github.com/filebrowser/filebrowser vulnerabilities

CVEs whose affected-version data names the github.com/filebrowser/filebrowser package (go). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

9 CVEsRSS

CVE-2026-54097High

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix

▾ Twilightfilebrowser · github.com/filebrowser/filebrowserEPSS 0.45%via GHSA

CVE-2026-54096High

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

▾ Twilightfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.18%via GHSA

CVE-2026-54092High· 6.5

File Browser has a DoS Vulnerability via Public Login API

File Browser has a DoS Vulnerability via Public Login API

▾ Twilightfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.55%via GHSA

CVE-2026-54094Medium· 6.8

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope

▾ Sunlitfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.50%via GHSA

CVE-2026-54093Medium

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

▾ Sunlitfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.19%via GHSA

CVE-2026-54091High· 7.5

File Browser has incorrect access control for public directory shares via rule path rebasing

File Browser has incorrect access control for public directory shares via rule path rebasing

▾ Twilightfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.52%via GHSA

CVE-2026-23849Medium· 5.3

File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login

File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login

▾ Sunlitfilebrowser · github.com/filebrowser/filebrowserEPSS 0.48%via OSV

CVE-2025-53826High

File Browser’s insecure JWT handling can lead to session replay attacks after logout

File Browser’s insecure JWT handling can lead to session replay attacks after logout

▾ Twilightfilebrowser · github.com/filebrowser/filebrowserEPSS 0.55%via OSV

CVE-2025-52996Low· 3.1

File Browser's password protection of links is bypassable

File Browser's password protection of links is bypassable

▾ Sunlitfilebrowser · github.com/filebrowser/filebrowser/v2EPSS 0.39%via OSV

github.com/filebrowser/filebrowser vulnerabilities (CVEs) · VulnSea