Input validation error in FileBrowser - #VU133482
Published: June 8, 2026
Vulnerability identifier: #VU133482
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper input validation in the CheckPwd function in users/password.go when handling login requests to the api/login endpoint. A remote user can send a specially crafted login request with an excessively large password to cause a denial of service.
Concurrent requests can spike CPU and memory usage and may cause the service to become unresponsive or crash.
Affected software
FileBrowser
Remediation
Install security update from vendor's website.
FileBrowser - update to 2.63.6