| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/filebrowser/filebrowser/v2 | < 2.45.2 | 2.45.2 |
The standard library net/http package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free