Skip to content
Noroxi

filebrowser records

32 published records for vendor filebrowser.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
87.5%
Median publish → KEV
No record has entered KEV

Records by year

  1. 22
  2. 23
  3. 25
  4. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

32 records
  • CVE-2026-32760
    40Plan

    File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin

    CriticalCVSS 10.0No exploitEPSS 1%

    filebrowser · filebrowserMar 19, 2026

  • CVE-2026-34528
    39Monitor

    File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

    CriticalCVSS 9.8No exploitEPSS 1%

    filebrowser · filebrowserApr 1, 2026

  • CVE-2021-46398
    37Monitor

    A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privile

    HighCVSS 8.8Proof of conceptEPSS 7%

    filebrowser · filebrowserFeb 4, 2022

  • CVE-2023-39612
    36Monitor

    A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate privileges to Administ

    CriticalCVSS 9.0No exploitEPSS 1%

    filebrowser · filebrowserSep 15, 2023

  • CVE-2026-34529
    36Monitor

    File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

    CriticalCVSS 9.0No exploitEPSS 0%

    filebrowser · filebrowserApr 1, 2026

  • CVE-2026-35607
    35Monitor

    File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands

    HighCVSS 8.8No exploitEPSS 1%

    filebrowser · filebrowserApr 7, 2026

  • CVE-2025-52903
    32Monitor

    File Browser Allows Execution of Shell Commands That Can Spawn Other Commands

    HighCVSS 8.0No exploitEPSS 1%

    filebrowser · filebrowserJun 26, 2025

  • CVE-2025-52904
    32Monitor

    File Browser: Command Execution not Limited to Scope

    HighCVSS 8.0No exploitEPSS 1%

    filebrowser · filebrowserJun 26, 2025

  • CVE-2026-29188
    32Monitor

    File Browser: TUS Delete Endpoint Bypasses Delete Permission Check

    HighCVSS 8.1No exploitEPSS 1%

    filebrowser · filebrowserMar 5, 2026

  • CVE-2026-25890
    32Monitor

    File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL

    HighCVSS 8.1Proof of conceptEPSS 1%

    filebrowser · filebrowserFeb 9, 2026

  • CVE-2026-35604
    32Monitor

    File Browser share links remain accessible after Share/Download permissions are revoked

    HighCVSS 8.2No exploitEPSS 0%

    filebrowser · filebrowserApr 7, 2026

  • CVE-2026-35585
    31Monitor

    File Browser has a Command Injection via Hook Runner

    HighCVSS 7.5Proof of conceptEPSS 2%

    filebrowser · filebrowserApr 7, 2026

  • CVE-2026-30933
    30Monitor

    FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

    HighCVSS 7.5No exploitEPSS 1%

    filebrowser · filebrowserMar 10, 2026

  • CVE-2025-52997
    30Monitor

    File Browser Insecurely Handles Passwords

    HighCVSS 7.5No exploitEPSS 1%

    filebrowser · filebrowserJun 30, 2025

  • CVE-2025-53826
    30Monitor

    FileBrowser Has Insecure JWT Handling Which Allows Session Replay Attacks after Logout

    HighCVSS 7.7No exploitEPSS 1%

    filebrowser · filebrowserJul 15, 2025

  • CVE-2025-53893
    30Monitor

    File Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File Processing

    HighCVSS 7.7No exploitEPSS 0%

    filebrowser · filebrowserJul 15, 2025

  • CVE-2026-28492
    28Monitor

    File Browser: Path Traversal in Public Share Links Exposes Files Outside Shared Directory

    HighCVSS 7.1No exploitEPSS 0%

    filebrowser · filebrowserMar 5, 2026

  • CVE-2025-64523
    28Monitor

    FileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion Function

    HighCVSS 7.2No exploitEPSS 0%

    filebrowser · filebrowserNov 12, 2025

  • CVE-2026-34530
    27Monitor

    File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

    MediumCVSS 6.9No exploitEPSS 0%

    filebrowser · filebrowserApr 1, 2026

  • CVE-2025-52995
    26Monitor

    File Browser vulnerable to command execution allowlist bypass

    MediumCVSS 6.6No exploitEPSS 1%

    filebrowser · filebrowserJun 30, 2025

  • CVE-2025-52901
    26Monitor

    File Browser allows sensitive data to be transferred in URL

    MediumCVSS 6.5No exploitEPSS 1%

    filebrowser · filebrowserJun 30, 2025

  • CVE-2026-32761
    26Monitor

    File Browser has an Authorization Policy Bypass in its Public Share Download Flow

    MediumCVSS 6.5No exploitEPSS 0%

    filebrowser · filebrowserMar 19, 2026

  • CVE-2026-32758
    26Monitor

    File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter

    MediumCVSS 6.5No exploitEPSS 0%

    filebrowser · filebrowserMar 19, 2026

  • CVE-2026-35605
    25Monitor

    File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

    MediumCVSS 6.3No exploitEPSS 0%

    filebrowser · filebrowserApr 7, 2026

  • CVE-2026-32759
    22Monitor

    File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely

    MediumCVSS 5.3No exploitEPSS 2%

    filebrowser · filebrowserMar 19, 2026