CVE-2026-90927

Name of the Vulnerable Software and Affected Versions filebrowser versions prior to 2.63.24

Description Authenticated users can cause a denial of service by sending oversized WebSocket messages to the '/api/command' endpoint. The application fails to limit the message size before verifying permissions, which allows the buffering of arbitrarily large messages. This process can exhaust the server heap memory, leading to a system crash, regardless of the EnableExec setting or the user's Execute permission.

Recommendations Update to version 2.63.24 or later.