filebrowser

3 results · Clear filters · Feed

• Critical 9.3
  CVE-2026-54088 Public exploit

  File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

  File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to a…

  filebrowser filebrowser github.com/filebrowser/filebrowser/v2 github.com/filebrowser/filebrowser Go
  Jun 25, 2026
• High 7.5
  CVE-2026-35585 Public exploit

  File Browser has a Command Injection via Hook Runner

  File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file eve…

  filebrowser filebrowser github.com/filebrowser/filebrowser/v2 github.com/filebrowser/filebrowser Go
  Apr 7, 2026
• High 8.1
  CVE-2026-25890 Public exploit

  File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

  File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the …

  filebrowser filebrowser github.com/filebrowser/filebrowser/v2 github.com/filebrowser/filebrowser Go
  Feb 9, 2026