Vulnerability · Published Sep 14, 2026 · Assigned by VulnCheck

CVE-2026-90928File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

Medium 6.5

In plain English

A medium-severity uncontrolled resource consumption in filebrowser from filebrowser. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 62.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.

Affected products (as reported)

Vendor	Product	Versions
filebrowser	filebrowser	0 – through 2.63.23

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-448h-jr2h-3vhp) vendor-advisory
VulnCheck Advisory: File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint third-party-advisory