These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The CVE-2026-82238 vulnerability is a race condition in the TUS upload handler of filebrowser version 2.24.0. This allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests at the same offset, bypassing length validation. As a result, files can exceed their declared size, triggering completion hooks for oversized uploads. The vulnerability has a CVSS score of [truncated]
CVE-2026-72838 debrief based on the supplied source corpus. The CVE record was published on 2026-08-14T12:16:47.313Z and has not been modified since then. FileBrowser versions before 2.63.19 are affected by a vulnerability that allows authenticated users to write arbitrary data to disk via the TUS resumable-upload PATCH endpoint. This can lead to disk space exhaustion and service unavailability. Defenders [truncated]
CVE-2026-72837 debrief based on the supplied source corpus. The CVE record was published on 2026-08-14T12:16:47.187Z and has not been modified since then. This vulnerability affects File Browser versions before 2.63.20, allowing attackers with valid credentials to access and modify files of other users. Defenders should assess exposure and verify versions to prevent unauthorized file access. The CVE recor [truncated]
CVE-2026-72836 debrief based on the supplied source corpus. FileBrowser before version 2.63.19 does not account for case-insensitive filesystems when checking home directory ownership during self-registration. This allows for unauthorized access to files on case-insensitive filesystems like Windows/NTFS. Defenders should assess exposure and verify secure configuration. The CVE record and NVD entry provide [truncated]
CVE-2026-72835 debrief based on the supplied source corpus. The vulnerability affects filebrowser versions before v2.63.21, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. This could lead to unauthorized access to denied files within user scope. Defenders should assess exposure, verify version, review deny rules, and monitor logs for [truncated]
CVE-2026-72834 is a permission bypass vulnerability in filebrowser before version 2.63.19. The /api/resources endpoint allows an authenticated user with limited permissions to obtain a content-hash oracle for any file in the same scope, enabling content confirmation, change detection, and offline brute-force attacks on low-entropy files. This issue bypasses the Download permission and does not defeat scop [truncated]
CVE-2026-72839 debrief based on the supplied source corpus. The vulnerability in filebrowser through 2.63.16 allows unauthenticated attackers to register accounts with elevated permissions, potentially leading to unrestricted file access. Defenders should assess exposure and prioritize remediation for filebrowser instances with self-signup enabled. This involves verifying the current version, reviewing co [truncated]
CVE-2026-73613 debrief based on the supplied source corpus. The vulnerability exists in filebrowser versions before 2.63.19; an out-of-scope file deletion vulnerability in the TUS upload cache eviction mechanism allows authenticated users with only Create permission to delete arbitrary files outside their scope by swapping an ancestor directory with a symlink during the cache TTL window. Defenders should [truncated]
CVE-2026-73612 debrief based on the supplied source corpus. File Browser before v2.63.22 fails to validate access rules for descendants during recursive copy, rename, and delete operations, allowing authenticated users to bypass path-based access controls. This vulnerability affects File Browser deployments, potentially leading to unauthorized file operations and compromising confidentiality and integrity [truncated]
CVE-2026-73611 debrief based on the supplied source corpus. The CVE record was published on 2026-08-13T12:17:25.747Z and has not been modified since then. File Browser versions from 2.50.0 through 2.63.21 are affected by a high-severity vulnerability that allows attackers to bypass JWT expiration checks, potentially leading to indefinite access to protected routes and administrative endpoints. Defenders r [truncated]
CVE-2026-62685 is a high-severity vulnerability in File Browser, a file managing interface, that allows unauthorized access to user files. Prior to version 2.63.17, File Browser's username normalization can collapse multiple usernames to the same home directory without checking for existing scopes, enabling a second registrant to gain full read and write access to another user's files.
CVE-2026-61874 is a low-severity vulnerability in filebrowser versions before 2.63.17. The vulnerability allows authenticated users to leave stale public shares behind by failing to normalize paths before querying the share index in DeleteWithPathPrefix. An attacker can exploit this by deleting a shared directory using a trailing-slash path and then recreating the same directory to expose new contents thr [truncated]
CVE-2026-35585 is a high-severity vulnerability in File Browser, a file managing interface, that allows for Remote Code Execution (RCE) via OS command injection. The vulnerability exists in versions 2.0.0 through 2.33.8 and is caused by the hook system's use of os.Expand without sanitization, allowing an attacker with file write permission to craft a malicious filename containing shell metacharacters. Thi [truncated]
CVE-2026-32759 is a vulnerability in the File Browser TUS resumable upload handler. In versions on the 2.x branch prior to 2.33.8, an authenticated user can supply a negative Upload-Length value, which is parsed as a signed 64-bit integer without validation. This allows the user to instantly satisfy the upload completion condition upon the first PATCH request, causing the server to fire after_upload exec [truncated]