CVE-2026-90927: filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
filebrowserto a version that resolves this vulnerability.Fixed in 2.63.23Patch Denial of Service via unbounded WebSocket message
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be authenticated to Filebrowser and able to connect to the /api/command WebSocket handler. No additional Execute permission is required.
Does disabling command execution prevent exploitation?
No. The issue can be exploited regardless of the EnableExec setting or whether the authenticated user has Execute permission, because message buffering occurs before permission checks.
What is the impact of a successful attack?
An authenticated attacker can send arbitrarily large WebSocket messages, consuming server heap memory and causing a denial of service.
Which versions are affected?
Filebrowser through version 2.63.23 is affected.