# github.com/filebrowser/filebrowser/v2 (Go) vulnerabilities Source: https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 45 vulnerabilities in github.com/filebrowser/filebrowser/v2 (Go): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-62684, was published on 20 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 45 (2 critical, 0 exploited in the wild) ## About github.com/filebrowser/filebrowser/v2 (Go) A Go-based file management interface that provides a web UI for local or remote file systems. ## Latest github.com/filebrowser/filebrowser/v2 (Go) vulnerabilities - [CVE-2026-62684: File Browser sensitive information disclosure in Share API](https://junglewise.ai/threats/cve-2026-62684-file-browser-sensitive-information-disclosure-in-share-api) (low, CVSS 3.1, published 20 Jul 2026) - [CVE-2026-62843: File Browser path traversal in archive builder via backslash filenames](https://junglewise.ai/threats/cve-2026-62843-file-browser-path-traversal-in-archive-builder-via-backslash) (medium, CVSS 6.8, published 15 Jul 2026) - [CVE-2026-62685: File Browser directory traversal and isolation bypass via username normalization collision](https://junglewise.ai/threats/cve-2026-62685-file-browser-directory-traversal-and-isolation-bypass-via) (high, CVSS 8.1, published 15 Jul 2026) - [CVE-2026-55668: File Browser path traversal via dangling symlink in ScopedFs](https://junglewise.ai/threats/cve-2026-55668-file-browser-path-traversal-via-dangling-symlink-in-scopedfs) (medium, CVSS 6.3, published 8 Jul 2026) - [CVE-2026-34530: File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection](https://junglewise.ai/threats/cve-2026-34530-file-browser-vulnerable-to-stored-cross-site-scripting-via-text) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-34528: File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution](https://junglewise.ai/threats/cve-2026-34528-file-browser-s-signup-grants-execution-permissions-when-default) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-35604: File Browser share links remain accessible after Share/Download permissions are revoked](https://junglewise.ai/threats/cve-2026-35604-file-browser-share-links-remain-accessible-after-share-download) (medium, CVSS 4, published 25 Jun 2026) - [CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup](https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload) (high, CVSS 8.2, published 25 Jun 2026) - [CVE-2026-54097: File Browser authorization bypass in share-link deletion](https://junglewise.ai/threats/cve-2026-54097-file-browser-authorization-bypass-in-share-link-deletion) (high, CVSS 4, published 25 Jun 2026) - [CVE-2026-54096: File Browser improper authorization via pre-created public shares](https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares) (high, CVSS 8.4, published 25 Jun 2026) - [CVE-2026-54094: File Browser symlink following scope bypass](https://junglewise.ai/threats/cve-2026-54094-file-browser-symlink-following-scope-bypass) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-54093: File Browser path traversal in archive download via backslash separators](https://junglewise.ai/threats/cve-2026-54093-file-browser-path-traversal-in-archive-download-via-backslash) (medium, CVSS 4, published 25 Jun 2026) - [CVE-2026-54092: File Browser denial of service via large password in login API](https://junglewise.ai/threats/cve-2026-54092-file-browser-denial-of-service-via-large-password-in-login-api) (medium, CVSS 6.5, published 25 Jun 2026) - [CVE-2026-54091: File Browser incorrect authorization in public directory shares](https://junglewise.ai/threats/cve-2026-54091-file-browser-incorrect-authorization-in-public-directory-shares) (high, CVSS 7.5, published 25 Jun 2026) - [CVE-2026-54090: File Browser command allowlist bypass via shell metacharacter injection](https://junglewise.ai/threats/cve-2026-54090-file-browser-command-allowlist-bypass-via-shell-metacharacter) (high, CVSS 4, published 25 Jun 2026) - [CVE-2026-54089: File Browser authentication bypass via forged proxy headers](https://junglewise.ai/threats/cve-2026-54089-file-browser-authentication-bypass-via-forged-proxy-headers) (critical, CVSS 9.1, published 25 Jun 2026) - [CVE-2026-54088: File Browser OS command injection in Hook Authentication](https://junglewise.ai/threats/cve-2026-54088-file-browser-os-command-injection-in-hook-authentication) (critical, CVSS 4, published 25 Jun 2026) - [CVE-2026-35607: File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands](https://junglewise.ai/threats/cve-2026-35607-file-browser-proxy-auth-auto-provisioned-users-inherit-execute) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-35605: File Browser has an access rule bypass via HasPrefix without trailing separator in path matching](https://junglewise.ai/threats/cve-2026-35605-file-browser-has-an-access-rule-bypass-via-hasprefix-without) (medium, CVSS 4, published 25 Jun 2026) - [CVE-2026-34529: File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file](https://junglewise.ai/threats/cve-2026-34529-file-browser-is-vulnerable-to-stored-cross-site-scripting-via) (low, CVSS 3.1, published 25 Jun 2026) - [CVE-2026-35606: File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check](https://junglewise.ai/threats/cve-2026-35606-file-browser-discloses-text-file-content-via-api-resources) (medium, CVSS 4, published 25 Jun 2026) - [CVE-2026-35585: File Browser OS command injection in hook system](https://junglewise.ai/threats/cve-2026-35585-file-browser-os-command-injection-in-hook-system) (high, CVSS 7.2, published 7 Apr 2026) - [CVE-2026-32761: File Browser has an Authorization Policy Bypass in Public Share Download Flow](https://junglewise.ai/threats/cve-2026-32761-file-browser-has-an-authorization-policy-bypass-in-public-share) (low, CVSS 3.1, published 7 Apr 2026) - [CVE-2026-32758: File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter](https://junglewise.ai/threats/cve-2026-32758-file-browser-has-an-access-rule-bypass-via-path-traversal-in-copy) (low, CVSS 3.1, published 26 Mar 2026) - [CVE-2026-32760: GO-2026-4710 - File Browser Signup Grants Admin When Default Permissions Include Admin in github.com/filebrowser/filebrowser](https://junglewise.ai/threats/cve-2026-32760-file-browser-signup-grants-admin-when-default-permissions-include) (medium, CVSS 4, published 26 Mar 2026) ## Most severe github.com/filebrowser/filebrowser/v2 (Go) vulnerabilities - [CVE-2026-54089: File Browser authentication bypass via forged proxy headers](https://junglewise.ai/threats/cve-2026-54089-file-browser-authentication-bypass-via-forged-proxy-headers) (critical, CVSS 9.1, published 25 Jun 2026) - [CVE-2026-54088: File Browser OS command injection in Hook Authentication](https://junglewise.ai/threats/cve-2026-54088-file-browser-os-command-injection-in-hook-authentication) (critical, CVSS 4, published 25 Jun 2026) - [CVE-2025-64523: File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function](https://junglewise.ai/threats/cve-2025-64523-file-browser-is-vulnerable-to-insecure-direct-object-reference) (high, CVSS 8.8, published 12 Nov 2025) - [CVE-2026-54096: File Browser improper authorization via pre-created public shares](https://junglewise.ai/threats/cve-2026-54096-file-browser-improper-authorization-via-pre-created-public-shares) (high, CVSS 8.4, published 25 Jun 2026) - [CVE-2026-55667: File Browser arbitrary file deletion via symlink in upload cleanup](https://junglewise.ai/threats/cve-2026-55667-file-browser-arbitrary-file-deletion-via-symlink-in-upload) (high, CVSS 8.2, published 25 Jun 2026) - [CVE-2026-32759: File Browser improper validation in TUS upload handler](https://junglewise.ai/threats/cve-2026-32759-file-browser-improper-validation-in-tus-upload-handler) (high, CVSS 8.1, published 20 Mar 2026) - [CVE-2026-62685: File Browser directory traversal and isolation bypass via username normalization collision](https://junglewise.ai/threats/cve-2026-62685-file-browser-directory-traversal-and-isolation-bypass-via) (high, CVSS 8.1, published 15 Jul 2026) - [CVE-2025-52903: File Browser arbitrary command execution via allowlist bypass](https://junglewise.ai/threats/cve-2025-52903-file-browser-arbitrary-command-execution-via-allowlist-bypass) (high, CVSS 8, published 26 Jun 2025) - [CVE-2025-52904: File Browser scope bypass via Command Execution feature](https://junglewise.ai/threats/cve-2025-52904-file-browser-scope-bypass-via-command-execution-feature) (high, CVSS 8, published 26 Jun 2025) - [CVE-2026-54091: File Browser incorrect authorization in public directory shares](https://junglewise.ai/threats/cve-2026-54091-file-browser-incorrect-authorization-in-public-directory-shares) (high, CVSS 7.5, published 25 Jun 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Go technologies - [github.com/mattermost/mattermost-server (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server): 297 vulnerabilities - [github.com/mattermost/mattermost-server/v6 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v6): 222 vulnerabilities - [github.com/mattermost/mattermost/server/v8 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v8): 207 vulnerabilities - [github.com/mattermost/mattermost-server/v5 (Go)](https://junglewise.ai/threats/technologies/github-com-mattermost-mattermost-server-v5): 199 vulnerabilities - [stdlib (Go)](https://junglewise.ai/threats/technologies/go-stdlib): 178 vulnerabilities - [github.com/siyuan-note/siyuan/kernel (Go)](https://junglewise.ai/threats/technologies/github-com-siyuan-note-siyuan-kernel): 160 vulnerabilities - [code.gitea.io/gitea (Go)](https://junglewise.ai/threats/technologies/code-gitea-io-gitea): 126 vulnerabilities - [code.vikunja.io/api (Go)](https://junglewise.ai/threats/technologies/code-vikunja-io-api): 91 vulnerabilities - [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs): 81 vulnerabilities - [github.com/traefik/traefik/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik-v2): 78 vulnerabilities - [github.com/traefik/traefik (Go)](https://junglewise.ai/threats/technologies/github-com-traefik-traefik): 75 vulnerabilities - [github.com/usememos/memos (Go)](https://junglewise.ai/threats/technologies/github-com-usememos-memos): 75 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "github.com/filebrowser/filebrowser/v2 (Go) vulnerabilities", https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2, 13 November 2026.