CVE-2026-54092: File Browser has a DoS Vulnerability via Public Login API

June 12, 2026

Unchecked passwords maximums allow for an arbitrarily large password to be passed into the login API. This spikes CPU and memory, and after testing, crashes, heavily lags any container created, and has even made my docker daemon start to send errors with status code 500 even after the container was destroyed.

References

github.com/advisories/GHSA-w5fm-68j4-fpc4
github.com/filebrowser/filebrowser/commit/847d08bdd135e5c3659f2e6dea2f0cd36617af9b
github.com/filebrowser/filebrowser/releases/tag/v2.63.6
github.com/filebrowser/filebrowser/security/advisories/GHSA-w5fm-68j4-fpc4
nvd.nist.gov/vuln/detail/CVE-2026-54092

Code Behaviors & Features

Detect and mitigate CVE-2026-54092 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →