VulertSecurity VulertSecurity

Vulnerability Database · Go · Package report

github.com/filebrowser/filebrowser: vulnerability history, versions and safety

github.com/filebrowser/filebrowser is a package in the Go ecosystem. Vulert records 47 vulnerabilities for it across 120 releases, from Jul 2025 to Jul 2026. Each vulnerability names the versions it affects, the fixed version to move to, and a workaround where no fix has been published.

i
47 vulnerabilities recorded H3 M1 U43
i
47 with no fix published

No patched version yet — these are the ones to plan around.

See the unfixed vulnerabilities →
i
36 in the last 12 months

Most recent disclosure 22 Jul 2026.

See the disclosure history →
i
0 malicious-package vulnerabilities

No published version shipped hostile code.

See all github.com/filebrowser/filebrowser vulnerabilities

Vulert verdict on github.com/filebrowser/filebrowser v1.11.0 i

Updated on 23 Oct 2026

Careful: v1.11.0 has 46 known vulnerabilities, and 46 have no fix yet. Use an earlier safe version, or the workaround listed for each one.

Package health score 49/100
  • Security Unfixed issues
  • Maintenance Slowing
  • Popularity Key ecosystem project
  • Community Moderate

The current release has a vulnerability with no published fix, which caps this score.

What to do: Pin an earlier, unaffected release if you can, and apply the workaround each vulnerability lists until a fix is published. No fix yet: Vulert alerts you the moment one is published. Monitor it with Vulert →

  • Current release v1.11.0 — affected i
  • Vulnerabilities on record 47 over 1 year · 36 in the last year i
  • Latest disclosure 22 Jul 2026 i
  • Highest CVSS 7.7 i
  • With no published fix 47 i
  • Stars 35,886 i
  • OpenSSF scorecard 4/10 i
  • Last release 93 months ago i
  • Licence Apache-2.0 i

Version list, release dates, licence and dependants published by the Go module proxy, refreshed 22 Oct 2026. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Versions

Which versions are affected

Every version Vulert tracks for github.com/filebrowser/filebrowser, newest first, with the vulnerabilities recorded against each one. A version showing none has no vulnerability in the Vulert database — open it for the full picture on that release.

i
Version Released Vulert vulnerabilities Licence Fix published Details
v0.0.0-20190521101359-7414ca10b314 21 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190520210656-d45d7f92fb16 20 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190514080547-bb0d0482351e 14 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190513144340-b991c65d8b0f 13 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190512095827-633579e7380a 12 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190511215950-ead7fb42338f 11 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190511173813-31b70a7736e7 11 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190511173759-bbeadee98e2c 11 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190509122836-df42e352f779 09 May 2019 H3 M1 U42 — No Details →
v0.0.0-20190429124318-1f985fe72f82 29 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190429124306-575296d7fc18 29 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190426123305-b93dc9f2003a 26 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190425131600-6255f737ba48 25 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190420124531-3ed2144a0e7e 20 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190417134426-a437761d03bd 17 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190417134417-b432e1bf4602 17 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190417134404-8dd59e3e67c9 17 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190415121557-fd5543407a27 15 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190415121544-48d012ff921f 15 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190409140113-2c4eae5ca282 09 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190402074052-629646122fa1 02 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190402074044-d4f284f1a3c9 02 Apr 2019 H3 M1 U42 — No Details →
v0.0.0-20190329122017-ff3b5b39a517 29 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190328144920-9667980f2d28 28 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190328144911-188a34f8353d 28 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190327113752-f9cd5f11d97a 27 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190320212213-adedf0178b90 20 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190320155123-4e15b8289664 20 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190319204531-ed0ea34161c9 19 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190318112405-e2ffd360735f 18 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190314114436-6bd2a1852fb3 14 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190312112718-371236e36436 12 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190312112009-6cbdc9d7c56d 12 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190312111952-a94125f3f2df 12 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190308175206-2f5f5d75a7a0 08 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190308175154-02f2284f3b70 08 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190305144551-2b1305a315a7 05 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190304133754-ec78f67abda1 04 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190304133746-25c04af500fa 04 Mar 2019 H3 M1 U42 — No Details →
v0.0.0-20190222112234-c0391d866ee2 22 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190222112222-dcb97be587a8 22 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190222112211-c6eb98aef278 22 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190222112200-1c6e15c064db 22 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190220113458-711a3a30b0d0 20 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190220113449-e203ca14f408 20 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190219184056-0f1b69b62594 19 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190218192314-176eaad70b62 18 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190218181549-486dfe4e634c 18 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190218181540-81cf4bab99e0 18 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190215125608-9c3f563f8352 15 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190215120946-6b42781c21cb 15 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190214132408-891a0d1bd0cc 14 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190212160843-3b9063dc6358 12 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190212081646-2bfdffb9c40a 12 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190208084249-9f8685bf10be 08 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190206192756-b58bc414bfb8 06 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190204203832-0b817231184f 04 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190201123803-66418ec064e6 01 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190201123532-d87640a4f134 01 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190201123521-e5580ac0c402 01 Feb 2019 H3 M1 U42 — No Details →
v0.0.0-20190130121654-b92c800e0062 30 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190129090545-e370fbe5007c 29 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190126154923-89d4d828b9ec 26 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190126112758-d004015f0335 26 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190126112110-ba5b5fbfe3a9 26 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190126104648-dd29a87107ee 26 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190123144850-b394540f535b 23 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190122173341-3ed5f8c0bd53 22 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190122173332-5d5cef2a877e 22 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190121145554-9264e344d7ef 21 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190121145546-0a46ac3e1ba6 21 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190119083732-a438fc746f98 19 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190118141100-0c8ffaf73ea1 18 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190118112612-6c1bbb324888 18 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190117155401-e663c60a8925 17 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190116145128-e1e8979e0bec 16 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190116145115-de53b24536f1 16 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190114125221-bc518a0e82ca 14 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190108141624-2ed87febcb71 08 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190108140523-ee169b3a4666 08 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190108125744-90d690c18727 08 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190106120123-0e7d4ef110ee 06 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190106100608-7a6397af2238 06 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190106094941-ac512612e790 06 Jan 2019 H3 M1 U42 — No Details →
v1.11.1-0.20190105212641-53a46013618c 05 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.11.0 05 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20190105212628-bc8d19feff01 05 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v0.0.0-20190105162409-95fc3dfdfbe2 05 Jan 2019 H3 M1 U42 — No Details →
v0.0.0-20190105161209-39be89780efd 05 Jan 2019 H3 M1 U42 — No Details →
v1.10.1-0.20190102023535-f77009365f13 02 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20190102021353-74e93b8df0b4 02 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20190101021858-901dc2c160c2 01 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20190101013945-b5ee82c94377 01 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20190101012209-8e4805ba6991 01 Jan 2019 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20181230174745-694c750561b1 30 Dec 2018 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20181228233946-efa3b3f19874 28 Dec 2018 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20181228191954-998dd9430dcd 28 Dec 2018 H3 M1 U42 Apache-2.0 No Details →
v1.10.1-0.20181225234843-c8b57287434f 25 Dec 2018 H3 M1 U42 Apache-2.0 No Details →
v0.0.0-20181224173308-2642333928b2 24 Dec 2018 H3 M1 U42 Apache-2.0 No Details →
v0.0.0-20181205112526-7e1d74543552 05 Dec 2018 H3 M1 U42 Apache-2.0 No Details →
v0.0.0-20181119171525-218e638f8869 19 Nov 2018 H3 M1 U42 — No Details →
v1.10.1-0.20181119032124-fab33e3ed1d3 19 Nov 2018 H3 M1 U42 — No Details →
v0.0.0-20181111221636-cad2a989c14b 11 Nov 2018 H3 M1 U42 — No Details →
v0.0.0-20181111162042-f844aeb2b409 11 Nov 2018 H3 M1 U42 — No Details →
v0.0.0-20181023233049-7847763a3195 23 Oct 2018 H3 M1 U42 — No Details →
v0.0.0-20181008224221-3f49bc382efc 08 Oct 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180908193039-5079f405fca5 08 Sep 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180908180312-b85a07536dc6 08 Sep 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180823232438-7e3a15e0734d 23 Aug 2018 H3 M1 U42 — No Details →
v0.0.0-20180823232020-3ae9e518a30e 23 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180823054744-aeb4e2aab3a3 23 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180823054511-bd65bc9e44a0 23 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180822152530-59468830bb7a 22 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180822122434-d7c3665e2bf1 22 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180822121555-679b0f0f4ea8 22 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180822120921-7d912dd25757 22 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180822113055-a92d7aab8e59 22 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180822002951-0536d8342c2d 22 Aug 2018 H3 M1 U42 — No Details →
v0.0.0-20180821114837-1e5ced67370c 21 Aug 2018 H3 M1 U42 — No Details →
v1.10.1-0.20180820094106-93acf4a6f7fa 20 Aug 2018 H3 M1 U42 — No Details →

The newest 120 of 1,664 versions Vulert tracks. Severity counts are the vulnerabilities recorded against that exact release.

02 Disclosure history

How often vulnerabilities are recorded

  • 2025 14
  • 2026 33

Counted by the year Vulert recorded each vulnerability — the same date the table below shows as disclosed. 36 of the 47 were recorded in the last 12 months.

03 Vulnerabilities

Recorded vulnerabilities for github.com/filebrowser/filebrowser

The 5 most severe of 47 vulnerabilities recorded for this package

Search all 47 in the database →
Vulnerability Severity Fixed version ↓ Disclosed ↓
CVE-2025-53826: File Browser's Insecure JWT Handling Leads to Session Replay Attacks 7.7 high No fix published 16 Jul 2025
CVE-2026-54097: File Browser Cross-User Unauthorized Share-Link Deletion Vulnerability 7.2 high No fix published 12 Jun 2026
CVE-2025-64523: File Browser Insecure Direct Object Reference in Share Deletion Function 7.2 high No fix published 13 Nov 2025
CVE-2026-23849: File Browser Username Enumeration via Timing Attack 5.3 medium No fix published 21 Jan 2026
CVE-2026-54093: File Browser Path Traversal Vulnerability in github.com/filebrowser/filebrowser N/A unrated No fix published 25 Jun 2026

Vulnerability wrong, a fix missing, or a package we should cover? Report it and we will fix the record. Report Vulnerability Provide Feedback

Updated: 23/Oct/2026 · Vulnerabilities in our DB: 524315

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/filebrowser/filebrowser

Is github.com/filebrowser/filebrowser safe to use?

Vulert records 47 vulnerabilities for github.com/filebrowser/filebrowser in Go: 0 critical, 3 high, 1 medium and 0 low, plus 43 not yet rated. 47 of them have no published fix yet, so those are the ones to avoid or mitigate.

What is github.com/filebrowser/filebrowser's Vulert package health score?

Vulert scores github.com/filebrowser/filebrowser 49/100, which reads as risky. The score weighs the vulnerability record (40), maintenance and release cadence (25), adoption from dependents and stars (20) and community signals such as the OpenSSF scorecard and forks (15). The current release has a vulnerability with no published fix, which caps this score.

Is the latest version of github.com/filebrowser/filebrowser affected?

Yes. v1.11.0, the version you would install today, has 46 known vulnerabilities, and 46 has no published fix yet. Use an earlier unaffected release, or the workaround each vulnerability lists.

Which version of github.com/filebrowser/filebrowser should I use?

v1.11.0 is the version Vulert recommends for the affected releases. The version table above lists every release with the vulnerabilities recorded against it, so you can confirm the range you actually run.

How many vulnerabilities does github.com/filebrowser/filebrowser have?

47 vulnerabilities are recorded for github.com/filebrowser/filebrowser in the Go ecosystem: 0 critical, 3 high, 1 medium and 0 low, plus 43 not yet rated. The ledger on this page lists the same counts next to the date of the most recent disclosure.

How often are new github.com/filebrowser/filebrowser vulnerabilities disclosed?

36 vulnerabilities were recorded for github.com/filebrowser/filebrowser in the last 12 months, and the oldest entry in this database dates to 16 Jul 2025. Recency matters more than a lifetime total: it shows how actively new issues are being disclosed for the package you are considering.

Which versions of github.com/filebrowser/filebrowser are affected?

Each vulnerability on this page lists the affected version range and the fixed version to move to. Open the vulnerability for the version you actually run — fixes are specific to a release line, not to the package as a whole.

How do I monitor github.com/filebrowser/filebrowser for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/filebrowser/filebrowser version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.