CVE-2026-90927

filebrowser through version 2.63.23 fails to limit the size of WebSocket messages accepted by the /api/command handler before performing permission checks, allowing any authenticated user to buffer arbitrarily large messages in server memory. An attacker sends oversized WebSocket messages to exhaust the server's heap and cause denial of service, crashing or freezing the service. The flaw is exploitable regardless of the EnableExec setting or whether the account holds the Execute permission, so every user with valid credentials is a potential attacker. Affected deployments are self-hosted filebrowser instances — commonly run on NAS devices, home labs, and cloud servers, sometimes directly exposed to the internet. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no in-the-wild exploitation has been reported as of this analysis.

What to do: Upgrade to the latest filebrowser release newer than 2.63.23 as soon as the maintainers ship a fix (a specific patched version was not stated in the advisory). In the meantime, front filebrowser with a reverse proxy that enforces WebSocket frame/message size limits, cap the process's memory (e.g., Docker memory constraints) so a flood cannot take down the host, and audit user accounts since exploitation requires valid credentials but no special permissions.