Security: gtsteffaniak/filebrowser
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Path traversal in subtitle handler allows any authenticated user to read arbitrary filesGHSA-vvp7-h4fj-m28w published
Jun 10, 2026 by gtsteffaniakHigh -
unauthenticated user share share infoGHSA-3jmg-p96m-m328 published
May 14, 2026 by gtsteffaniakCritical -
Path traversal in public share PATCH allows file ops outside shared directoryGHSA-qqqm-5547-774x published
May 16, 2026 by gtsteffaniakCritical -
Stored XSS via SVG File in Public Share (Missing CSP Header)GHSA-mmpx-jh39-wrv6 published
May 1, 2026 by gtsteffaniakModerate -
Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File DeletionGHSA-fwj3-42wh-8673 published
May 1, 2026 by gtsteffaniakCritical -
Missing Rate Limiting on Authentication Endpoint Enables Brute Force AttacksGHSA-r4v7-6wcg-ghj5 published
May 22, 2026 by gtsteffaniakModerate -
Username Enumeration via Authentication Timing Side-ChannelGHSA-7789-65hx-f26w published
Mar 21, 2026 by gtsteffaniakModerate -
Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoGHSA-525j-95gf-766f published
Mar 7, 2026 by gtsteffaniakHigh -
Stored XSS in public share page via unsanitized share metadata (text/template misuse)GHSA-r633-fcgp-m532 published
Mar 7, 2026 by gtsteffaniakHigh -
Bypassable share passwordsGHSA-8vrh-3pm2-v4v6 published
Feb 21, 2026 by gtsteffaniakModerate