# CVE-2026-90927: filebrowser WebSocket message denial of service in /api/command

Source: https://junglewise.ai/threats/cve-2026-90927-filebrowser-websocket-message-denial-of-service-in-api-command  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-14. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90927 · Severity: medium · CVSS 6.5 · Published 2026-09-14

filebrowser is a web-based file manager and browser that allows users to upload, download, and manage files through a web interface. An authenticated attacker can send oversized WebSocket messages to the command endpoint, causing the application server to allocate excessive memory and become unresponsive, resulting in service unavailability. This can happen even if command execution is disabled or the attacker lacks permission to execute commands.

Technologies: [Filebrowser](https://junglewise.ai/threats/technologies/filebrowser). Vendors: [FileBrowser](https://junglewise.ai/threats/vendors/filebrowser).

## Quick answers

**Is CVE-2026-90927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90927 being exploited in the wild.

**How severe is CVE-2026-90927?** Medium severity, with a CVSS score of 6.5, published 14 September 2026.

**Which products and versions are affected?** Filebrowser through 2.63.23.

**Is there a fix for CVE-2026-90927?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90927 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-90927?** Check whether you run Filebrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /api/command WebSocket handler in filebrowser through 2.63.23 fails to set a read limit on incoming WebSocket messages, allowing the handler to buffer complete messages in memory before checking authorization. The vulnerability is triggered in the commandsHandler function, which calls conn.ReadMessage() to read a full client message prior to validating either the EnableExec setting or the user's Perm.Execute permission. gorilla/websocket applies no default message size limit when SetReadLimit is not invoked, causing arbitrarily large messages to be fully buffered on the heap. An authenticated user can exploit this by sending progressively larger or concurrent WebSocket messages to exhaust server memory and trigger denial of service. The project is archived and unmaintained, with no patch available; the recommended workaround is to block /api/command at the reverse proxy level.

## Affected products

- filebrowser filebrowser through 2.63.23

## Timeline

- 2026-08-31: disclosed: Advisory published on GitHub
- 2026-09-14: advisory: CVE-2026-90927 published

## References

- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p)
- [https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-denial-of-service-via-unbounded-websocket-message](https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-denial-of-service-via-unbounded-websocket-message)

## Related threats

- [filebrowser race condition in TUS upload handler](https://junglewise.ai/threats/cve-2026-82238-filebrowser-race-condition-in-tus-upload-handler)
- [filebrowser stale share link via file rename](https://junglewise.ai/threats/cve-2026-82237-filebrowser-stale-share-link-via-file-rename)
- [filebrowser named pipe blocking in archive and public download handlers](https://junglewise.ai/threats/cve-2026-82235-filebrowser-named-pipe-blocking-in-archive-and-public-download)
- [filebrowser privilege escalation via self-signup](https://junglewise.ai/threats/cve-2026-72839-filebrowser-privilege-escalation-via-self-signup)
- [filebrowser out-of-scope file deletion via symlink in TUS cache eviction](https://junglewise.ai/threats/cve-2026-73613-filebrowser-out-of-scope-file-deletion-via-symlink-in-tus-cache)