CVE-2026-54092
published 2026-06-25CVE-2026-54092: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6…
PriorityP339medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.48%
38.1th percentile
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing, crashes, heavily lags any container created, and has even made my docker daemon start to send errors with status code 500 even after the container was destroyed. This vulnerability is fixed in 2.63.6.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.6 | 2.63.6 |
| github.com | filebrowser_filebrowser | 0 – 1.11.0 | — |
| github.com | filebrowser_filebrowser_v2 | >= 0 < 2.63.6 | 2.63.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
filebrowser File Browser up to 2.63.5 Login API improper validation of specified quantity in input (GHSA-w5fm-68j4-fpc4)
vuldb·2026-06-26·CVSS 6.5
CVE-2026-54092 [MEDIUM] filebrowser File Browser up to 2.63.5 Login API improper validation of specified quantity in input (GHSA-w5fm-68j4-fpc4)
A vulnerability described as problematic has been identified in filebrowser File Browser up to 2.63.5. This affects an unknown function of the component Login API. Executing a manipulation can lead to improper validation of specified quantity in input.
This vulnerability appears as CVE-2026-54092. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is recommended.
GHSA
File Browser has a DoS Vulnerability via Public Login API
ghsa·2026-06-12
CVE-2026-54092 [HIGH] CWE-1284 File Browser has a DoS Vulnerability via Public Login API
File Browser has a DoS Vulnerability via Public Login API
### Summary
Unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing, crashes, heavily lags any container created, and has even made my docker daemon start to send errors with status code 500 even after the container was destroyed.
### Details
When sending JSON in the body of the request to the route `api/login`, if a large password is sent, there is no checking on a maximum length password. This means that any length string can be sent to the server and it will be hashed. Specifically the function `CheckPwd` in `users/password.go` is called to hash and check to see if the user supplied password is valid, but there is no maximum length for t
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/filebrowser/filebrowser/commit/847d08bdd135e5c3659f2e6dea2f0cd36617af9bhttps://github.com/filebrowser/filebrowser/releases/tag/v2.63.6https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w5fm-68j4-fpc4https://vincent.vulcoord.net/score/?state=Not+Scored&year=2026&year=2025&assigned_to=a165dae3-480e-4f7d-bbb8-9b1d78115b69&cve=CVE-2026-54092&analyze=1
2026-06-25
Published