Documentation
Source Files
Directories
Click to show internal directories.
Click to hide internal directories.
Affected by GO-2025-3784
and 42 other vulnerabilities
GO-2025-3784: filebrowser allows Stored Cross-Site Scripting through the Markdown preview function in github.com/filebrowser/filebrowser
GO-2025-3785: filebrowser Sets Insecure File Permissions in github.com/filebrowser/filebrowser
GO-2025-3786: filebrowser Allows Shell Commands to Spawn Other Commands in github.com/filebrowser/filebrowser
GO-2025-3790: File Browser's password protection of links is bypassable in github.com/filebrowser/filebrowser
GO-2025-3792: File Browser vulnerable to insecure password handling in github.com/filebrowser/filebrowser
GO-2025-3793: File Browser: Command Execution not Limited to Scope in github.com/filebrowser/filebrowser
GO-2025-3794: File Browser allows sensitive data to be transferred in URL in github.com/filebrowser/filebrowser
GO-2025-3795: File Browser vulnerable to command execution allowlist bypass in github.com/filebrowser/filebrowser
GO-2025-3811: File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing in github.com/filebrowser/filebrowser
GO-2025-3812: File Browser’s insecure JWT handling can lead to session replay attacks after logout in github.com/filebrowser/filebrowser
GO-2025-4117: File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function in github.com/filebrowser/filebrowser
GO-2025-4118: File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser
GO-2026-4344: File Browser Vulnerable to Username Enumeration via Timing Attack in /api/login in github.com/filebrowser/filebrowser
GO-2026-4474: File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL in github.com/filebrowser/filebrowser
GO-2026-4475: File Browser has an Authentication Bypass in User Password Update in github.com/filebrowser/filebrowser
GO-2026-4585: FileBrowser has Path Traversal in Public Share Links that Exposes Files Outside Shared Directory in github.com/filebrowser/filebrowser
GO-2026-4606: File Browser's TUS Delete Endpoint Bypasses Delete Permission Check in github.com/filebrowser/filebrowser
GO-2026-4710: File Browser Signup Grants Admin When Default Permissions Include Admin in github.com/filebrowser/filebrowser
GO-2026-4711: File Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination Parameter in github.com/filebrowser/filebrowser
GO-2026-4713: File Browser TUS Negative Upload-Length Fires Post-Upload Hooks Prematurely in github.com/filebrowser/filebrowser
GO-2026-4738: File Browser has an Authorization Policy Bypass in Public Share Download Flow in github.com/filebrowser/filebrowser
GO-2026-5055: File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser
GO-2026-5096: File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser
GO-2026-5150: File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser
GO-2026-5156: File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser
GO-2026-5159: File Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefix in github.com/filebrowser/filebrowser
GO-2026-5167: File Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check in github.com/filebrowser/filebrowser
GO-2026-5205: File Browser: Proxy auth auto-provisioned users inherit Execute permission and Commands in github.com/filebrowser/filebrowser
GO-2026-5250: File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection in github.com/filebrowser/filebrowser
GO-2026-5411: File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser
GO-2026-5458: File Browser has incorrect access control for public directory shares via rule path rebasing in github.com/filebrowser/filebrowser
GO-2026-5481: File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser
GO-2026-5659: File Browser share links remain accessible after Share/Download permissions are revoked in github.com/filebrowser/filebrowser
GO-2026-5691: File Browser has a DoS Vulnerability via Public Login API in github.com/filebrowser/filebrowser
GO-2026-5747: File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution in github.com/filebrowser/filebrowser
GO-2026-5754: File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection in github.com/filebrowser/filebrowser
GO-2026-5962: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) in github.com/filebrowser/filebrowser
GO-2026-5966: File Browser: Authentication Bypass via Proxy Auth Header Forgery in github.com/filebrowser/filebrowser
GO-2026-6020: File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope in github.com/filebrowser/filebrowser
GO-2026-6021: File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup in github.com/filebrowser/filebrowser
GO-2026-6024: File Browser: Colliding username normalization gives two users the same home directory in github.com/filebrowser/filebrowser
GO-2026-6025: File Browser: Share API exposes the password hash and bypass token in github.com/filebrowser/filebrowser
GO-2026-6026: File Browser: Archive builder turns backslash filenames into path traversal (zip-slip) in github.com/filebrowser/filebrowser
The highest tagged major version is
v2.
cli
command
v1.11.0
Go to latest
Published: Jan 5, 2019
License: Apache-2.0
Opens a new window with list of versions in this module.
Latest
Latest
This package is not in the latest version of its module.
Opens a new window with license information.
Imports: 1
Opens a new window with list of imports.
Imported by: 0
Opens a new window with list of known importers.