CVE-2026-82235: Filebrowser

Medium severity, CVSS 5.9. EPSS: 0.5% chance of exploitation in the next 30 days.

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.

Affected products

• Filebrowser Filebrowser: up to and including 2.63.23

Published 2026-08-28. Last modified 2026-09-24.