Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-90928— File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint

Quick assessment

Affected
filebrowser filebrowser
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

File Browser 2.63.23 及更早版本中存在一个内存耗尽漏洞，该漏洞位于字幕转换端点。该端点在加载整个字幕文件到内存时未设置文件大小限制。拥有下载权限的已认证攻击者可以通过请求转换大型 .srt、.ass 或 .ssa 文件，并通过并发请求耗尽服务器内存，从而导致服务拒绝（DoS）攻击。

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90928

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
Source: CVE Program / CVE List V5
Vulnerability Description
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
filebrowser filebrowser 0 ~ 2.63.23 -

II. Public POCs for CVE-2026-90928

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90928

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-90928 (2)

Same Patch Batch · filebrowser · 2026-09-14 · 4 CVEs total

CVE-2026-90929 8.1 HIGH File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup
CVE-2026-90930 6.8 MEDIUM File Browser through 2.63.23 Path Traversal via Symlink Alias
CVE-2026-90927 6.5 MEDIUM filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message

IV. Related Vulnerabilities

Same product: filebrowser
Same vendor: filebrowser
Same weakness: CWE-400

V. Comments for CVE-2026-90928

No comments yet

Leave a comment