# FileBrowser vulnerabilities

Source: https://junglewise.ai/threats/technologies/filebrowser  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/filebrowser.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 19 vulnerabilities in FileBrowser: 0 in the last 7 days and 4 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-90927, was published on 14 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 4
- All time: 19 (2 critical, 0 exploited in the wild)

## About FileBrowser

Web-based file manager for browsing and managing files on a server or local system.

## Latest FileBrowser vulnerabilities

- [CVE-2026-90927: filebrowser WebSocket message denial of service in /api/command](https://junglewise.ai/threats/cve-2026-90927-filebrowser-websocket-message-denial-of-service-in-api-command) (medium, CVSS 6.5, published 14 Sep 2026)
- [CVE-2026-82238: filebrowser race condition in TUS upload handler](https://junglewise.ai/threats/cve-2026-82238-filebrowser-race-condition-in-tus-upload-handler) (low, CVSS 3.1, published 28 Aug 2026)
- [CVE-2026-82237: filebrowser stale share link via file rename](https://junglewise.ai/threats/cve-2026-82237-filebrowser-stale-share-link-via-file-rename) (low, CVSS 3.1, published 28 Aug 2026)
- [CVE-2026-82235: filebrowser named pipe blocking in archive and public download handlers](https://junglewise.ai/threats/cve-2026-82235-filebrowser-named-pipe-blocking-in-archive-and-public-download) (medium, CVSS 5.9, published 28 Aug 2026)
- [CVE-2026-72839: filebrowser privilege escalation via self-signup](https://junglewise.ai/threats/cve-2026-72839-filebrowser-privilege-escalation-via-self-signup) (critical, CVSS 9.8, published 13 Aug 2026)
- [CVE-2026-73613: filebrowser out-of-scope file deletion via symlink in TUS cache eviction](https://junglewise.ai/threats/cve-2026-73613-filebrowser-out-of-scope-file-deletion-via-symlink-in-tus-cache) (high, CVSS 8.2, published 13 Aug 2026)
- [CVE-2026-62684: File Browser sensitive information disclosure in Share API](https://junglewise.ai/threats/cve-2026-62684-file-browser-sensitive-information-disclosure-in-share-api) (low, CVSS 3.1, published 20 Jul 2026)
- [CVE-2026-62843: File Browser path traversal in archive builder via backslash filenames](https://junglewise.ai/threats/cve-2026-62843-file-browser-path-traversal-in-archive-builder-via-backslash) (medium, CVSS 6.8, published 15 Jul 2026)
- [CVE-2026-61874: filebrowser incorrect authorization via path normalization in DeleteWithPathPrefix](https://junglewise.ai/threats/cve-2026-61874-filebrowser-incorrect-authorization-via-path-normalization-in) (low, CVSS 3.1, published 12 Jul 2026)
- [CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup](https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload) (high, CVSS 8.2, published 25 Jun 2026)
- [CVE-2026-54097: File Browser authorization bypass in share-link deletion](https://junglewise.ai/threats/cve-2026-54097-file-browser-authorization-bypass-in-share-link-deletion) (high, CVSS 4, published 25 Jun 2026)
- [CVE-2026-54096: File Browser improper authorization via pre-created public shares](https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares) (high, CVSS 8.4, published 25 Jun 2026)
- [CVE-2026-54093: File Browser path traversal in archive download via backslash separators](https://junglewise.ai/threats/cve-2026-54093-file-browser-path-traversal-in-archive-download-via-backslash) (medium, CVSS 4, published 25 Jun 2026)
- [CVE-2026-44542: gtsteffaniak FileBrowser Quantum path traversal in public share delete](https://junglewise.ai/threats/cve-2026-44542-gtsteffaniak-filebrowser-quantum-path-traversal-in-public-share) (critical, CVSS 9.1, published 14 May 2026)
- [CVE-2026-35585: File Browser OS command injection in hook system](https://junglewise.ai/threats/cve-2026-35585-file-browser-os-command-injection-in-hook-system) (high, CVSS 7.2, published 7 Apr 2026)
- [CVE-2026-32759: File Browser improper validation in TUS upload handler](https://junglewise.ai/threats/cve-2026-32759-file-browser-improper-validation-in-tus-upload-handler) (high, CVSS 8.1, published 20 Mar 2026)
- [CVE-2025-64523: File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function](https://junglewise.ai/threats/cve-2025-64523-file-browser-is-vulnerable-to-insecure-direct-object-reference) (high, CVSS 8.8, published 12 Nov 2025)
- [CVE-2025-52904: File Browser scope bypass via Command Execution feature](https://junglewise.ai/threats/cve-2025-52904-file-browser-scope-bypass-via-command-execution-feature) (high, CVSS 8, published 26 Jun 2025)
- [CVE-2025-52903: File Browser arbitrary command execution via allowlist bypass](https://junglewise.ai/threats/cve-2025-52903-file-browser-arbitrary-command-execution-via-allowlist-bypass) (high, CVSS 8, published 26 Jun 2025)

## Most severe FileBrowser vulnerabilities

- [CVE-2026-72839: filebrowser privilege escalation via self-signup](https://junglewise.ai/threats/cve-2026-72839-filebrowser-privilege-escalation-via-self-signup) (critical, CVSS 9.8, published 13 Aug 2026)
- [CVE-2026-44542: gtsteffaniak FileBrowser Quantum path traversal in public share delete](https://junglewise.ai/threats/cve-2026-44542-gtsteffaniak-filebrowser-quantum-path-traversal-in-public-share) (critical, CVSS 9.1, published 14 May 2026)
- [CVE-2025-64523: File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function](https://junglewise.ai/threats/cve-2025-64523-file-browser-is-vulnerable-to-insecure-direct-object-reference) (high, CVSS 8.8, published 12 Nov 2025)
- [CVE-2026-54096: File Browser improper authorization via pre-created public shares](https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares) (high, CVSS 8.4, published 25 Jun 2026)
- [CVE-2026-73613: filebrowser out-of-scope file deletion via symlink in TUS cache eviction](https://junglewise.ai/threats/cve-2026-73613-filebrowser-out-of-scope-file-deletion-via-symlink-in-tus-cache) (high, CVSS 8.2, published 13 Aug 2026)
- [CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup](https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload) (high, CVSS 8.2, published 25 Jun 2026)
- [CVE-2026-32759: File Browser improper validation in TUS upload handler](https://junglewise.ai/threats/cve-2026-32759-file-browser-improper-validation-in-tus-upload-handler) (high, CVSS 8.1, published 20 Mar 2026)
- [CVE-2025-52903: File Browser arbitrary command execution via allowlist bypass](https://junglewise.ai/threats/cve-2025-52903-file-browser-arbitrary-command-execution-via-allowlist-bypass) (high, CVSS 8, published 26 Jun 2025)
- [CVE-2025-52904: File Browser scope bypass via Command Execution feature](https://junglewise.ai/threats/cve-2025-52904-file-browser-scope-bypass-via-command-execution-feature) (high, CVSS 8, published 26 Jun 2025)
- [CVE-2026-35585: File Browser OS command injection in hook system](https://junglewise.ai/threats/cve-2026-35585-file-browser-os-command-injection-in-hook-system) (high, CVSS 7.2, published 7 Apr 2026)

## Vulnerabilities per week

Nothing in the last four weeks, down from 1 vulnerability in the four before.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 0 | 0 | 0 |
| 24 Aug 2026 | 3 | 0 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 1 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "FileBrowser vulnerabilities", https://junglewise.ai/threats/technologies/filebrowser, 13 November 2026.