CVE Feed

    Dashboard / CVE / CVE-2026-90927

    CVE-2026-90927

    filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.

    Published:Sep 14, 2026
    Last Modified:Sep 16, 2026
    EPS:Sep 14, 2026
    EPSS Score:0.00249
    CVSS Score:6.5

    Affected Products

    Vendor
    Filebrowser
    Product
    Filebrowser

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-90930 (CVSS 7.6) — File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links with…
    CVE-2026-90929 (CVSS 7.2) — File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload end…
    CVE-2026-90928 (CVSS 7.1) — File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint th…
    CVE-2026-82238 (CVSS 2.3) — filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated …
    CVE-2026-82237 (CVSS 2.3) — filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion trigger…
    CVE-2026-82236 (CVSS 2.3) — File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user d…
    CVE-2026-82235 (CVSS 8.2) — filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, a…
    CVE-2026-62684 (CVSS 2.7) — File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit…
    CVE-2026-72838 (CVSS 7.1) — FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PAT…
    CVE-2026-72837 (CVSS 8.7) — File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authenticatio…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High