CVE-2026-82235

FileBrowser through 2.63.23 does not validate named pipes (FIFOs) when it builds directory archives or serves public downloads, so opening a FIFO blocks instead of returning file contents. An authenticated user, or an anonymous visitor holding a public share link, can repeatedly request archives or downloads that include a named pipe, causing repeated blocking open syscalls. Each blocked open pins a server goroutine, so an attacker who loops these requests can accumulate pinned goroutines and exhaust the instance's connection resources until the service stops responding. Any FileBrowser deployment is affected where served or shared directory trees may contain named pipes, with public share links representing the most exposed path. No public proof-of-concept exists, the issue is not in CISA KEV, and EPSS puts 30-day exploitation probability at about 0.4%, so no exploitation is currently known.

What to do: Upgrade to the first FileBrowser release after 2.63.23 as soon as a fixed version is published (no fixed version is identified in the available data; monitor the upstream advisory and the VulnCheck CNA disclosure). As interim mitigation, remove or exclude named pipes from served and shared directories, restrict or disable public share links (the unauthenticated attack path), and consider rate-limiting archive and download requests. Monitor instances for goroutine growth or connection exhaustion, which would indicate probing or exploitation.