CVE-2026-90927

EUVD-2026-77445
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
filebrowserfilebrowser
𝑥
≤ 2.63.23
CNA
Common Weakness Enumeration
References
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p
https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-denial-of-service-via-unbounded-websocket-message