Executive brief
File Browser, a web-based file management interface, is vulnerable to a denial-of-service attack. An attacker can send an excessively large password during the login process, which forces the server to consume massive amounts of CPU and memory. This can lead to the service crashing, becoming unresponsive, or even impacting the stability of the underlying server or container environment.
Technical details
A denial-of-service vulnerability exists in File Browser's login API (api/login) due to uncontrolled resource consumption (CWE-400). The application fails to enforce a maximum length on the password field within the JSON request body. When a large string is submitted, the server attempts to process and hash the input using bcrypt, leading to high CPU and memory utilization. In containerized environments, this can lead to OOM (Out of Memory) kills or severe performance degradation of the Docker daemon. The fix, introduced in version 2.63.6, implements a 1 MiB limit on the request body using http.MaxBytesReader.
Affected products
- filebrowser File Browser < 2.63.6
Timeline
- 2026-06-03: patched: Version 2.63.6 released
- 2026-06-25: disclosed: CVE-2026-54092 published