# File Browser vulnerabilities Source: https://junglewise.ai/threats/technologies/file-browser Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/file-browser.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in File Browser: 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90930, was published on 14 September 2026. Nothing in the last four weeks, down from 3 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 4 - All time: 26 (2 critical, 0 exploited in the wild) ## About File Browser File Browser is a web-based file manager that provides a file managing interface within a specified directory. ## Latest File Browser vulnerabilities - [CVE-2026-90930: File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass) (medium, CVSS 6.8, published 14 Sep 2026) - [CVE-2026-90929: File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint) (high, CVSS 8.1, published 14 Sep 2026) - [CVE-2026-90928: File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion) (medium, CVSS 6.5, published 14 Sep 2026) - [CVE-2026-82236: File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file) (low, CVSS 3.1, published 28 Aug 2026) - [CVE-2026-73612: File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive) (high, CVSS 8.1, published 13 Aug 2026) - [CVE-2026-73611: File Browser JWT expiration bypass in proxy authentication](https://junglewise.ai/threats/cve-2026-73611-file-browser-jwt-expiration-bypass-in-proxy-authentication) (medium, CVSS 6.8, published 13 Aug 2026) - [CVE-2026-62684: File Browser sensitive information disclosure in Share API](https://junglewise.ai/threats/cve-2026-62684-file-browser-sensitive-information-disclosure-in-share-api) (low, CVSS 3.1, published 20 Jul 2026) - [CVE-2026-62843: File Browser path traversal in archive builder via backslash filenames](https://junglewise.ai/threats/cve-2026-62843-file-browser-path-traversal-in-archive-builder-via-backslash) (medium, CVSS 6.8, published 15 Jul 2026) - [CVE-2026-62685: File Browser directory traversal and isolation bypass via username normalization collision](https://junglewise.ai/threats/cve-2026-62685-file-browser-directory-traversal-and-isolation-bypass-via) (high, CVSS 8.1, published 15 Jul 2026) - [CVE-2026-62683: File Browser incorrect authorization via stale public shares](https://junglewise.ai/threats/cve-2026-62683-file-browser-incorrect-authorization-via-stale-public-shares) (low, CVSS 3.1, published 15 Jul 2026) - [CVE-2026-61874: filebrowser incorrect authorization via path normalization in DeleteWithPathPrefix](https://junglewise.ai/threats/cve-2026-61874-filebrowser-incorrect-authorization-via-path-normalization-in) (low, CVSS 3.1, published 12 Jul 2026) - [CVE-2026-55668: File Browser path traversal via dangling symlink in ScopedFs](https://junglewise.ai/threats/cve-2026-55668-file-browser-path-traversal-via-dangling-symlink-in-scopedfs) (medium, CVSS 6.3, published 8 Jul 2026) - [CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup](https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload) (high, CVSS 8.2, published 25 Jun 2026) - [CVE-2026-54097: File Browser authorization bypass in share-link deletion](https://junglewise.ai/threats/cve-2026-54097-file-browser-authorization-bypass-in-share-link-deletion) (high, CVSS 4, published 25 Jun 2026) - [CVE-2026-54096: File Browser improper authorization via pre-created public shares](https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares) (high, CVSS 8.4, published 25 Jun 2026) - [CVE-2026-54094: File Browser symlink following scope bypass](https://junglewise.ai/threats/cve-2026-54094-file-browser-symlink-following-scope-bypass) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-54093: File Browser path traversal in archive download via backslash separators](https://junglewise.ai/threats/cve-2026-54093-file-browser-path-traversal-in-archive-download-via-backslash) (medium, CVSS 4, published 25 Jun 2026) - [CVE-2026-54092: File Browser denial of service via large password in login API](https://junglewise.ai/threats/cve-2026-54092-file-browser-denial-of-service-via-large-password-in-login-api) (medium, CVSS 6.5, published 25 Jun 2026) - [CVE-2026-54091: File Browser incorrect authorization in public directory shares](https://junglewise.ai/threats/cve-2026-54091-file-browser-incorrect-authorization-in-public-directory-shares) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-54090: File Browser command allowlist bypass via shell metacharacter injection](https://junglewise.ai/threats/cve-2026-54090-file-browser-command-allowlist-bypass-via-shell-metacharacter) (high, CVSS 4, published 25 Jun 2026) - [CVE-2026-54089: File Browser authentication bypass via forged proxy headers](https://junglewise.ai/threats/cve-2026-54089-file-browser-authentication-bypass-via-forged-proxy-headers) (critical, CVSS 9.1, published 25 Jun 2026) - [CVE-2026-54088: File Browser OS command injection in Hook Authentication](https://junglewise.ai/threats/cve-2026-54088-file-browser-os-command-injection-in-hook-authentication) (critical, CVSS 4, published 25 Jun 2026) - [CVE-2026-35585: File Browser OS command injection in hook system](https://junglewise.ai/threats/cve-2026-35585-file-browser-os-command-injection-in-hook-system) (high, CVSS 7.2, published 7 Apr 2026) - [CVE-2026-32759: File Browser improper validation in TUS upload handler](https://junglewise.ai/threats/cve-2026-32759-file-browser-improper-validation-in-tus-upload-handler) (high, CVSS 8.1, published 20 Mar 2026) - [CVE-2025-52904: File Browser scope bypass via Command Execution feature](https://junglewise.ai/threats/cve-2025-52904-file-browser-scope-bypass-via-command-execution-feature) (high, CVSS 8, published 26 Jun 2025) ## Most severe File Browser vulnerabilities - [CVE-2026-54089: File Browser authentication bypass via forged proxy headers](https://junglewise.ai/threats/cve-2026-54089-file-browser-authentication-bypass-via-forged-proxy-headers) (critical, CVSS 9.1, published 25 Jun 2026) - [CVE-2026-54088: File Browser OS command injection in Hook Authentication](https://junglewise.ai/threats/cve-2026-54088-file-browser-os-command-injection-in-hook-authentication) (critical, CVSS 4, published 25 Jun 2026) - [CVE-2026-54096: File Browser improper authorization via pre-created public shares](https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares) (high, CVSS 8.4, published 25 Jun 2026) - [CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup](https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload) (high, CVSS 8.2, published 25 Jun 2026) - [CVE-2026-32759: File Browser improper validation in TUS upload handler](https://junglewise.ai/threats/cve-2026-32759-file-browser-improper-validation-in-tus-upload-handler) (high, CVSS 8.1, published 20 Mar 2026) - [CVE-2026-62685: File Browser directory traversal and isolation bypass via username normalization collision](https://junglewise.ai/threats/cve-2026-62685-file-browser-directory-traversal-and-isolation-bypass-via) (high, CVSS 8.1, published 15 Jul 2026) - [CVE-2026-73612: File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive) (high, CVSS 8.1, published 13 Aug 2026) - [CVE-2026-90929: File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint) (high, CVSS 8.1, published 14 Sep 2026) - [CVE-2025-52903: File Browser arbitrary command execution via allowlist bypass](https://junglewise.ai/threats/cve-2025-52903-file-browser-arbitrary-command-execution-via-allowlist-bypass) (high, CVSS 8, published 26 Jun 2025) - [CVE-2025-52904: File Browser scope bypass via Command Execution feature](https://junglewise.ai/threats/cve-2025-52904-file-browser-scope-bypass-via-command-execution-feature) (high, CVSS 8, published 26 Jun 2025) ## Vulnerabilities per week Nothing in the last four weeks, down from 3 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 3 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "File Browser vulnerabilities", https://junglewise.ai/threats/technologies/file-browser, 12 November 2026.