Mọi CVE đã công bố cùng các advisory mã nguồn mở (NVD, OSV, GitHub), kèm CVSS, EPSS và cho biết lỗ hổng có đang bị khai thác thực tế hay không (CISA KEV). Cập nhật mỗi vài giờ. Các bài quét đối chiếu dữ liệu này với công nghệ phát hiện được trên site.
| 20/03/2026 |
| CVE-2026-32760 | NGHIÊM TRỌNG9.8 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions 2.61.2 and below, any unauthenticated visitor can register a full administrator account when self-registration (signup = true) is enabled and the default user permissions | 20/03/2026 |
| CVE-2026-32759 | CAO8.1 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. In versions on the 2.x branch prior to 2.33.8, the TUS resumable upload handler parses the Upload-Length header as a signed 64-bit integer without validating that the value is non-neg | 20/03/2026 |
| CVE-2026-32758 | TRUNG BÌNH6.5 | File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Versions 2.61.2 and below are vulnerable to Path Traversal through the resourcePatchHandler (http/resource.go). The destination path in resourcePatchHandler is validated against acces | 20/03/2026 |
| CVE-2026-29188 | CAO8.1 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.1, a broken access control vulnerability in the TUS protocol DELETE endpoint allows authenticated users with only Create permission to delete arbitrary | 05/03/2026 |
| CVE-2026-28492 | TRUNG BÌNH6.5 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses filepath.Dir(link.Path) to compute the B | 05/03/2026 |
| CVE-2026-25890 | CAO8.1 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's "Disallow" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to | 09/02/2026 |
| CVE-2026-25889 | TRUNG BÌNH5.4 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) | 09/02/2026 |
| CVE-2026-23849 | TRUNG BÌNH5.3 | File Browser provides a file managing interface within a specified directory and can be used to upload, delete, preview, rename, and edit files. Prior to version 2.55.0, the JSONAuth. Auth function contains a logic flaw that allows unauthenticated attackers to enumerate valid usernames by measuring the response time of | 19/01/2026 |
| GO-2025-4118 | File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency in github.com/filebrowser/filebrowser | 17/11/2025 |
| GHSA-6jqf-mv7m-3q7p | NGHIÊM TRỌNG9.1 | File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency | 13/11/2025 |
| CVE-2025-64523 | CAO8.8 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Versions prior to 2.45.1 have an Insecure Direct Object Reference (IDOR) vulnerability in the FileBrowser application's share deletion functionality. This vulnerability allo | 12/11/2025 |
| CVE-2025-53893 | TRUNG BÌNH6.5 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.38.0, a Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint `Filebrowser-Server-IP:PORT/files/{file-name | 15/07/2025 |
| CVE-2025-53826 | NGHIÊM TRỌNG9.8 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename, and edit files. In version 2.39.0, File Browser’s authentication system issues long-lived JWT tokens that remain valid even after the user logs out. As of time of publication, no known pat | 15/07/2025 |
| CVE-2025-52997 | CAO7.5 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process insecure. Attackers could mount a brute-force attack to retrie | 30/06/2025 |
| CVE-2025-52996 | TRUNG BÌNH4.3 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions 2.32.0 and prior, the implementation of password protected links is error-prone, resulting in potential unprotected sharing of a file through a direct download l | 30/06/2025 |
| CVE-2025-52995 | TRUNG BÌNH6.6 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact | 30/06/2025 |
| CVE-2025-52901 | TRUNG BÌNH6.5 | File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to | 30/06/2025 |