gtsteffaniak FileBrowser missing rate limiting in login endpoint

Executive brief

FileBrowser, a web-based file management utility, contains a security flaw in its login system. The application fails to limit the number of login attempts, allowing an attacker to try thousands of passwords against a user account without being blocked. This could lead to unauthorized access to files and sensitive data, especially since the software's default settings allow for very short, simple passwords.

Technical details

The `/api/auth/login` endpoint in FileBrowser does not implement rate limiting, account lockout, or progressive backoff for failed authentication attempts. An attacker can perform high-frequency automated login attempts over the network without authentication. This vulnerability is exacerbated by a weak default password policy (minimum 5 characters) and can be combined with username enumeration timing attacks to identify and compromise valid accounts. The issue was addressed in version 0.0.0-20260522161427-fa5abc8c67f3a.

Affected products

• gtsteffaniak FileBrowser < 0.0.0-20260522161427-fa5abc8c67f3a

Timeline

• 2026-05-22: patched: Fix committed to repository
• 2026-06-25: advisory: GitHub Advisory published

References

• https://api.github.com/users/mdcoxe
• https://github.com/mdcoxe
• https://api.github.com/users/mdcoxe/gists%7B/gist_id%7D
• https://api.github.com/users/mdcoxe/repos
• https://avatars.githubusercontent.com/u/72583004?v=4
• https://api.github.com/users/mdcoxe/events%7B/privacy%7D