Quick answers
- Is CVE-2026-90928 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-90928 being exploited in the wild.
- How severe is CVE-2026-90928?
- Medium severity, with a CVSS score of 6.5, published 14 September 2026.
- Which products and versions are affected?
- File Browser through 2.63.23.
- Is there a fix for CVE-2026-90928?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-90928 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-90928?
- Check whether you run File Browser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400) flaw in the subtitle conversion endpoint (/api/subtitle). The subtitle handler loads entire .srt, .ass, or .ssa subtitle files into memory without applying the 10 MB size limit that protects other file-read paths. An authenticated attacker with Download permission can trigger this by requesting conversion of a large subtitle file (which they may create via upload if they have Create permission). The server allocates multiple times the file size in memory during processing; concurrent requests exhaust available memory and terminate the process. The vulnerability requires authentication and download permission, but no user interaction. Patches are not available as the project is no longer maintained.
Affected products
- File Browser File Browser through 2.63.23
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-448h-jr2h-3vhp published; project archived
- 2026-09-14: advisory: CVE-2026-90928 published