CVE-2026-73611: Filebrowser

Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days.

File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint.

Affected products

• Filebrowser Filebrowser: from 2.50.0, up to and including 2.63.21

Published 2026-08-13. Last modified 2026-09-30.