Executive brief
filebrowser is a web-based file manager used to browse and download files from servers. When archiving directories or downloading files via public share links, the application fails to block named pipes (special files used for inter-process communication). An attacker can craft requests involving these special files to cause the server to hang indefinitely, pinning server resources and eventually denying service to legitimate users through resource exhaustion.
Technical details
The vulnerability is a resource exhaustion / denial-of-service issue in filebrowser's archive and public download handlers. The root cause is inconsistent validation of named pipes: while the single-file download handler (rawHandler) includes a guard to reject named pipes, the directory archive walker (getFiles) and public download handler (publicDlHandler) do not. When these handlers attempt to open a named pipe without a writer attached, the open(2) syscall blocks indefinitely. Because context cancellation cannot interrupt a blocking open syscall, the request goroutine and client connection remain pinned with no timeout mechanism to recover. Authenticated users can trigger this via the archive API endpoint, and anonymous visitors can trigger it via public share links pointing to directories containing or directly to a named pipe. Repeated requests accumulate pinned goroutines, degrading server availability. The project is no longer maintained and no patch will be released.
Affected products
- filebrowser filebrowser through 2.63.23
Timeline
- 2026-08-14: disclosed
- 2026-08-28: advisory
- other: Project archived and no longer maintained; no patch will be released