CVE-2026-82235

MediumCVSS 5.9/10Last modified Sep 24, 2026

Description

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
filebrowser	filebrowser	<= 2.63.23

References

Timeline

Published: Aug 28, 2026
Last modified: Sep 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-822363.1File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared f CVE-2026-822373.1filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share re CVE-2026-822383.1filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declar CVE-2026-822398.1Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASI CVE-2026-82247.5A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/c CVE-2026-822408.1Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an aut CVE-2026-822417.1Budibase backend-core (@budibase/backend-core, as used by @budibase/server) omits the shared address space range 100.64.0.0/10 from its defa CVE-2026-822427.7Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows auth CVE-2026-822437.6Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-lev CVE-2026-822449.1Budibase versions before 3.41.3 contain a remote code execution vulnerability in plugin handling that allows authenticated admin users to ex CVE-2026-822458.1Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete CVE-2026-822467.1Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-