CVE-2026-90928: File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
File Browserto a version that resolves this vulnerability.Fixed in 2.63.23 - Compensating control
Apply an availability mitigation for the subtitle conversion endpoint to prevent concurrent authenticated requests from exhausting server memory (e.g., rate limit/concurrency limit requests to the subtitle conversion endpoint).
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have download permission. They can target the subtitle conversion endpoint using large .srt, .ass, or .ssa files.
What is required to cause denial of service?
The attacker needs to request conversion of large subtitle files, potentially using concurrent requests. The endpoint loads whole files into memory without size limits, allowing server memory to be exhausted.
What is the expected impact?
Successful exploitation can exhaust server memory and cause a denial of service. The provided impact information indicates no confidentiality or integrity impact.