Executive brief
File Browser is a web-based file management interface that allows users to browse and download files from a server. The application contains a denial-of-service vulnerability in its subtitle file conversion feature that authenticated users can exploit by requesting conversion of very large subtitle files, causing the server to consume excessive memory and crash. This impacts availability for all users of the service.
Technical details
The vulnerability is an uncontrolled resource consumption (CWE-400) flaw in the subtitle conversion endpoint (/api/subtitle). The subtitle handler loads entire .srt, .ass, or .ssa subtitle files into memory without applying the 10 MB size limit that protects other file-read paths. An authenticated attacker with Download permission can trigger this by requesting conversion of a large subtitle file (which they may create via upload if they have Create permission). The server allocates multiple times the file size in memory during processing; concurrent requests exhaust available memory and terminate the process. The vulnerability requires authentication and download permission, but no user interaction. Patches are not available as the project is no longer maintained.
Affected products
- File Browser File Browser through 2.63.23
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-448h-jr2h-3vhp published; project archived
- 2026-09-14: advisory: CVE-2026-90928 published