CVE-2026-54092: File Browser denial of service via large password in login API

CVE-2026-54092 · Severity: medium · CVSS 6.5 · Published 2026-06-25

File Browser, a web-based file management interface, is vulnerable to a denial-of-service attack. An attacker can send an excessively large password during the login process, which forces the server to consume massive amounts of CPU and memory. This can lead to the service crashing, becoming unresponsive, or even impacting the stability of the underlying server or container environment.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-54092 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-54092 being exploited in the wild.
How severe is CVE-2026-54092?
Medium severity, with a CVSS score of 6.5, published 25 June 2026.
Which products and versions are affected?
File Browser < 2.63.6, <= 1.11.0; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.
Is there a fix for CVE-2026-54092?
Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54092 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54092?
Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later
    go get github.com/filebrowser/filebrowser/v2@v2.63.6

Technical details

A denial-of-service vulnerability exists in File Browser's login API (api/login) due to uncontrolled resource consumption (CWE-400). The application fails to enforce a maximum length on the password field within the JSON request body. When a large string is submitted, the server attempts to process and hash the input using bcrypt, leading to high CPU and memory utilization. In containerized environments, this can lead to OOM (Out of Memory) kills or severe performance degradation of the Docker daemon. The fix, introduced in version 2.63.6, implements a 1 MiB limit on the request body using http.MaxBytesReader.

Affected products

  • filebrowser File Browser < 2.63.6

Identifiers

  • CVE-2026-54092
  • GHSA-w5fm-68j4-fpc4
  • GO-2026-5691

Timeline

  • 2026-06-03: patched: Version 2.63.6 released
  • 2026-06-25: disclosed: CVE-2026-54092 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.