Vulnerabilidades em filebrowser
61 resultadosAnálise Vexday
O filebrowser apresenta um volume significativo de vulnerabilidades (43 CVEs) com concentração recente: 15 publicadas nos últimos 90 dias. Embora nenhuma esteja sob exploração ativa conhecida, 4 vulnerabilidades críticas foram registradas, sendo a falha de controle de acesso (CWE-863) o padrão dominante. O risco é moderado e em evolução, exigindo monitoramento atento das correções disponibilizadas.
CVE-2026-25890HIGHFile Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URLEPSS 0.5%CVE-2026-54097HIGHFile Browser: Cross-user unauthorized share-link deletion via unbounded prefix match in DeleteWithPathPrefixEPSS 0.4%CVE-2026-54090HIGHFile Browser: Command Allowlist Bypass via Shell Metacharacter InjectionEPSS 0.4%CVE-2025-64523HIGHFileBrowser has Insecure Direct Object Reference (IDOR) in Share Deletion FunctionEPSS 0.4%CVE-2026-32761MEDIUMFile Browser has an Authorization Policy Bypass in its Public Share Download FlowEPSS 0.4%CVE-2026-72835HIGHfilebrowser before v2.63.21 Access Rule Bypass via Path CanonicalizationEPSS 0.4%CVE-2026-90930HIGHFile Browser through 2.63.23 Path Traversal via Symlink AliasEPSS 0.4%CVE-2026-72836CRITICALFileBrowser before 2.63.19 Case Sensitivity Authentication BypassEPSS 0.4%CVE-2026-82235HIGHfilebrowser through 2.63.23 Denial of Service via named pipesEPSS 0.4%CVE-2026-62684LOWFile Browser: Share API exposes the password hash and bypass tokenEPSS 0.4%CVE-2026-35605MEDIUMFile Browser has an access rule bypass via HasPrefix without trailing separator in path matchingEPSS 0.4%CVE-2026-62843MEDIUMFile Browser: Archive builder turns backslash filenames into path traversal (zip-slip)EPSS 0.4%CVE-2026-32758MEDIUMFile Browser has an Access Rule Bypass via Path Traversal in Copy/Rename Destination ParameterEPSS 0.4%CVE-2026-35607HIGHFile Browser: Proxy auth auto-provisioned users inherit Execute permission and CommandsEPSS 0.4%CVE-2026-55668MEDIUMFile Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scopeEPSS 0.4%CVE-2026-73613HIGHfilebrowser before 2.63.19 Out-of-Scope File Deletion via SymlinkEPSS 0.4%CVE-2025-52996LOWFile Browser's Password Protection of Links Vulnerable to BypassEPSS 0.4%CVE-2025-53893HIGHFile Browser Vulnerable to Uncontrolled Memory Consumption Due to Oversized File ProcessingEPSS 0.4%CVE-2026-34530MEDIUMFile Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injectionEPSS 0.4%CVE-2026-35606MEDIUMFile Browser discloses text file content via /api/resources endpoint bypassing Perm.Download checkEPSS 0.3%