CVE-2026-90927
Received Received - Intake

WebSocket Message Size Handling Flaw in FileBrowser

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: VulnCheck

Description
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90927
EUVD
EUVD-2026-77445

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
filebrowser filebrowser to 2.63.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-90927 is a denial-of-service vulnerability in filebrowser versions up to 2.63.23. The /api/command WebSocket handler reads and buffers entire client messages before checking permissions. Authenticated users can send oversized messages, consuming excessive server memory and causing crashes or unresponsiveness regardless of command execution settings.

Detection Guidance

Monitor for unusually large WebSocket messages targeting the /api/command endpoint. Check server logs for excessive memory usage or crashes. Use network inspection tools like tcpdump or Wireshark to capture and analyze WebSocket traffic for abnormally sized payloads.

Impact Analysis

This vulnerability allows attackers to disrupt service by sending large WebSocket messages, exhausting server memory. It can make the filebrowser server unresponsive or crash, leading to downtime. The impact occurs even if command execution is disabled or the user lacks Execute permission.

Compliance Impact

This vulnerability primarily impacts availability by causing denial-of-service through memory exhaustion. While not directly violating GDPR or HIPAA, it could lead to service disruptions that affect data access or processing timelines, potentially impacting compliance with availability requirements in these regulations.

Mitigation Strategies

Block the /api/command endpoint at your reverse proxy (e.g., Nginx, Apache). Enforce memory limits on the filebrowser process and configure auto-restart policies. Disable WebSocket support if not required. Upgrade to a maintained fork if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart