Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck
CVE-2026-90927filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in filebrowser from filebrowser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 62.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| filebrowser | filebrowser | 0 – through 2.63.23 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-39cx-23x9-5c8p) vendor-advisory
- VulnCheck Advisory: filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message third-party-advisory