CVE-2026-82235: filebrowser through 2.63.23 Denial of Service via named pipes
filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Authenticated users can exploit it, as can anonymous visitors who have a public share link. The attacker must be able to request an archive that contains a named pipe.
What is the operational impact?
Repeated archive requests involving named pipes can cause blocking open system calls, pin server goroutines, and exhaust connection resources. This results in a denial of service rather than disclosure or modification of data.
Are public shares affected?
Yes. Public download handling is affected, so anonymous access through public share links can be sufficient when the shared content includes a named pipe.