# CVE-2026-82235: filebrowser named pipe blocking in archive and public download handlers

Source: https://junglewise.ai/threats/cve-2026-82235-filebrowser-named-pipe-blocking-in-archive-and-public-download  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82235 · Severity: medium · CVSS 5.9 · Published 2026-08-28

filebrowser is a web-based file manager used to browse and download files from servers. When archiving directories or downloading files via public share links, the application fails to block named pipes (special files used for inter-process communication). An attacker can craft requests involving these special files to cause the server to hang indefinitely, pinning server resources and eventually denying service to legitimate users through resource exhaustion.

Technologies: [Filebrowser](https://junglewise.ai/threats/technologies/filebrowser). Vendors: [FileBrowser](https://junglewise.ai/threats/vendors/filebrowser).

## Quick answers

**Is CVE-2026-82235 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82235 being exploited in the wild.

**How severe is CVE-2026-82235?** Medium severity, with a CVSS score of 5.9, published 28 August 2026.

**Which products and versions are affected?** Filebrowser through 2.63.23.

**Is there a fix for CVE-2026-82235?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-82235 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-82235?** Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a resource exhaustion / denial-of-service issue in filebrowser's archive and public download handlers. The root cause is inconsistent validation of named pipes: while the single-file download handler (rawHandler) includes a guard to reject named pipes, the directory archive walker (getFiles) and public download handler (publicDlHandler) do not. When these handlers attempt to open a named pipe without a writer attached, the open(2) syscall blocks indefinitely. Because context cancellation cannot interrupt a blocking open syscall, the request goroutine and client connection remain pinned with no timeout mechanism to recover. Authenticated users can trigger this via the archive API endpoint, and anonymous visitors can trigger it via public share links pointing to directories containing or directly to a named pipe. Repeated requests accumulate pinned goroutines, degrading server availability. The project is no longer maintained and no patch will be released.

## Affected products

- filebrowser filebrowser through 2.63.23

## Timeline

- 2026-08-14: disclosed
- 2026-08-28: advisory
- other: Project archived and no longer maintained; no patch will be released

## References

- [https://github.com/filebrowser/filebrowser/commit/586d198d](https://github.com/filebrowser/filebrowser/commit/586d198d)
- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8q5j-8wcr-8v2v](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8q5j-8wcr-8v2v)

## Related threats

- [filebrowser WebSocket message denial of service in /api/command](https://junglewise.ai/threats/cve-2026-90927-filebrowser-websocket-message-denial-of-service-in-api-command)
- [filebrowser race condition in TUS upload handler](https://junglewise.ai/threats/cve-2026-82238-filebrowser-race-condition-in-tus-upload-handler)
- [filebrowser stale share link via file rename](https://junglewise.ai/threats/cve-2026-82237-filebrowser-stale-share-link-via-file-rename)
- [filebrowser privilege escalation via self-signup](https://junglewise.ai/threats/cve-2026-72839-filebrowser-privilege-escalation-via-self-signup)
- [filebrowser out-of-scope file deletion via symlink in TUS cache eviction](https://junglewise.ai/threats/cve-2026-73613-filebrowser-out-of-scope-file-deletion-via-symlink-in-tus-cache)