CVE-2026-82235CWE-400denial-of-service

CVE-2026-82235

Medium · published August 28, 2026

CVSS v3.1
5.9
EPSS
1%
Percentile
43.0
In the wild
Unconfirmed
What it is

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00515 · 43.0th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2026-08-28T16:16Z
References (3)
https://github.com/filebrowser/filebrowser/commit/586d198d · [email protected]https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8q5j-8wcr-8v2v · [email protected]https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-denial-of-service-via-named-pipes · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 10:49Z
    filebrowser through 2.63.23 Denial of Service via named pipes
    cvelistv5