File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

filebrowser through 2.63.23 Denial of Service via named pipes

File Browser has Insecure File Permissions

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

File Browser has an Authentication Bypass in User Password Update

File Browser has Stored Cross-Site Scripting vulnerability

File Browser vulnerable to Username Enumeration via Timing Attack in /api/login

filebrowser before 2.63.19 Permission Bypass via checksum

File Browser's Password Protection of Links Vulnerable to Bypass

filebrowser 2.24.0 Race Condition via TUS concurrent PATCH uploads

filebrowser through 2.63.23 Stale Share Link via File Rename

File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion

File Browser: Trailing-slash delete leaves a stale public share behind

filebrowser before 2.63.17 Stale Public Share via Trailing-Slash Delete

File Browser: Share API exposes the password hash and bypass token