CVE-2026-82235 filebrowser through 2.63.23 Denial of Service via named pipes
Attackers can cause denial of service in filebrowser by requesting archives containing named pipes, exhausting server resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82235?
CVE-2026-82235 is a high-severity denial of service vulnerability in filebrowser, published on 28 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.
Weakness: CWE-400
Which versions are affected by CVE-2026-82235?
How do I fix CVE-2026-82235?
No fix has been published for CVE-2026-82235 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-82235 being exploited?
There is no known exploitation of CVE-2026-82235 in the wild and no public exploit code.
Sources
Also known as GHSA-8q5j-8wcr-8v2v, GHSA-j27f-mghv-p674.