Memory Exhaustion Vulnerability in File Browser by File Browser
CVE-2026-90928

7.1HIGH

Key Information:

Vendor

Filebrowser

Status
Filebrowser
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90928?

File Browser versions up to 2.63.23 are vulnerable to a memory exhaustion issue via the subtitle conversion endpoint. This vulnerability allows authenticated users with download permissions to send requests for converting large subtitle files, such as .srt, .ass, or .ssa formats, without any size limits. An attacker can exploit this flaw by making concurrent requests, ultimately consuming all available server memory and leading to a denial of service situation.

Affected Version(s)

filebrowser 0 <= 2.63.23

References

https://github.com/filebrowser/filebrowser/security/advis...
vendor-advisory
https://www.vulncheck.com/advisories/file-browser-through...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

1diot9
.