VulertSecurity VulertSecurity

Vulnerability Database · Go · github.com/filebrowser/filebrowser/v2 · Version

github.com/filebrowser/filebrowser/v2 v2.60.0

v2.60.0 is affected by 38 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: v2.63.23.

Critical 3 High 18 Medium 13 Low 2 Unrated 2

All github.com/filebrowser/filebrowser/v2 versions & vulnerabilities → Source repository Search the database for this package →
Released 21 Feb 2026 Licence Apache-2.0 Also known from other sources 52 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the Go module proxy. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

github.com/filebrowser/filebrowser/v2 v2.60.0 vulnerabilities

38 vulnerabilities cover github.com/filebrowser/filebrowser/v2 v2.60.0. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-32760: File Browser Vulnerability Allows Unauthenticated Admin Account Creation 10.0 critical 2.62.0 16 Mar 2026
CVE-2026-54088: File Browser Command Injection Vulnerability Leading to Pre-Authentication RCE 9.3 critical 2.63.6 10 Jul 2026
Critical HTTP Request/Response Smuggling Vulnerability in File Browser (CVE-2025-22871) 9.1 critical 2.45.2 13 Nov 2025
CVE-2021-46398: Cross-Site Request Forgery in Filebrowser 8.8 high 2.18.0 05 Feb 2022
CVE-2026-54090: File Browser Command Execution Allowlist Bypass via Shell Metacharacter Injection 8.7 high 2.33.8 12 Jun 2026
CVE-2026-55667: File Browser Arbitrary File Deletion via Symlink Following 8.2 high 2.63.16 20 Jul 2026
CVE-2026-35604: File Browser v2.62.2 Share Links Remain Accessible After Permissions Revocation 8.2 high 2.63.1 08 Apr 2026
CVE-2026-62685: FileBrowser Username Normalization Vulnerability Leading to Home Directory Collision 8.1 high 2.63.17 20 Jul 2026
CVE-2026-35607: File Browser Proxy Auth Users Inherit Execute Permissions 8.1 high 2.63.1 08 Apr 2026
CVE-2026-34528: File Browser's Signup Grants Execution Permissions to Unauthenticated Users 8.1 high 2.62.2 31 Mar 2026
CVE-2026-25890: File Browser Path-Based Access Control Bypass via Multiple Leading Slashes 8.1 high 2.57.1 10 Feb 2026
CVE-2025-52995: File Browser Command Execution Allowlist Bypass Vulnerability 8.0 high 2.33.10 30 Jun 2025
CVE-2025-52904: Filebrowser Command Execution Vulnerability Allows Unauthorized File Access 8.0 high No fix published 30 Jun 2025
CVE-2025-52903: File Browser Command Execution Vulnerability 8.0 high 2.33.10 27 Jun 2025
CVE-2025-53893: File Browser Denial of Service Vulnerability Due to Uncontrolled Memory Consumption 7.7 high No fix published 16 Jul 2025
CVE-2026-34529: File Browser Vulnerable to Stored XSS via Crafted EPUB File 7.6 high 2.62.2 31 Mar 2026
CVE-2025-52902: File Browser Stored XSS Vulnerability via Markdown Preview 7.6 high 2.33.7 27 Jun 2025
CVE-2026-54091: File Browser Incorrect Access Control in Public Directory Shares 7.5 high 2.63.6 12 Jun 2026
CVE-2026-54096: File Browser Improper Access Control via Pre-Created Public Share for Non-existent Path 7.1 high 2.63.7 12 Jun 2026
CVE-2026-28492: FileBrowser Path Traversal Vulnerability Exposing Files Outside Shared Directory 7.1 high 2.61.0 02 Mar 2026
CVE-2026-34530: File Browser Vulnerable to Stored XSS via Branding Injection 6.9 medium 2.62.2 31 Mar 2026
CVE-2026-54094: File Browser Symlink Vulnerability Allows Unauthorized File Access 6.8 medium 2.63.14 12 Jun 2026
CVE-2026-54092: File Browser DoS Vulnerability via Public Login API 6.5 high 2.63.6 12 Jun 2026
CVE-2026-32758: File Browser Path Traversal Vulnerability Leading to Access Rule Bypass 6.5 medium 2.62.0 16 Mar 2026
CVE-2026-55668: File Browser ScopedFs Vulnerability Allows Scoped Users to Create Files Outside Their Scope 6.3 medium 2.63.16 20 Jul 2026
CVE-2026-35605: File Browser Access Rule Bypass via Path Matching Issue 6.3 medium 2.63.1 08 Apr 2026
CVE-2026-54093: File Browser Path Traversal Vulnerability via Windows-Style Backslash Separators 6.2 medium 2.63.6 12 Jun 2026
CVE-2026-29188: File Browser TUS Delete Endpoint Bypass of Delete Permission Check 6.0 medium 2.61.1 04 Mar 2026
CVE-2025-52997: File Browser Insecure Password Handling Vulnerability 5.9 medium 2.34.1 30 Jun 2025
CVE-2025-52900: filebrowser Insecure File Permissions Vulnerability 5.5 medium 2.33.7 27 Jun 2025
CVE-2026-25889: File Browser Authentication Bypass in User Password Update 5.4 medium 2.57.1 10 Feb 2026
CVE-2026-35606: File Browser Bypasses Download Permission, Exposing Text File Content 5.3 medium 2.63.1 08 Apr 2026
CVE-2026-32759: File Browser TUS Negative Upload-Length Causes Premature Hook Execution 5.3 medium No fix published 16 Mar 2026
CVE-2025-52901: Filebrowser Exposes Sensitive Data via URL Parameters 4.5 medium 2.33.9 30 Jun 2025
CVE-2025-52996: File Browser's Password Protection Bypass Vulnerability 3.1 low No fix published 30 Jun 2025
CVE-2026-62684: File Browser Password Hash and Bypass Token Exposure Vulnerability 2.7 low 2.63.17 20 Jul 2026
CVE-2021-46398: Cross-Site Request Forgery in Filebrowser N/A unrated 2.18.0 05 Feb 2022
CVE-2021-46398: Cross-Site Request Forgery in github.com/filebrowser/filebrowser/v2 N/A unrated 2.18.0 05 Feb 2022

Looking for another version, or everything Vulert holds for github.com/filebrowser/filebrowser/v2?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About github.com/filebrowser/filebrowser/v2 v2.60.0

Is github.com/filebrowser/filebrowser/v2 v2.60.0 vulnerable?

Yes. 38 vulnerabilities in the Vulert database cover github.com/filebrowser/filebrowser/v2 v2.60.0: 3 critical, 18 high, 13 medium and 2 low, plus 2 not yet rated. The upgrade Vulert recommends is v2.63.23, and each entry above names the fixed version to move to.

Which version of github.com/filebrowser/filebrowser/v2 should I use instead of v2.60.0?

v2.63.23 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is v2.60.0 the latest release of github.com/filebrowser/filebrowser/v2?

No. v2.60.0 was published 21 Feb 2026, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor github.com/filebrowser/filebrowser/v2 for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the github.com/filebrowser/filebrowser/v2 version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.