Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/filebrowser/filebrowser/v2
  4. ›
  5. CVE-2025-53893

CVE-2025-53893: File Browser's Uncontrolled Memory Consumption vulnerability can enable DoS attack due to oversized file processing

July 16, 2025 (updated November 10, 2025)

A Denial of Service (DoS) vulnerability exists in the file processing logic when reading a file on endpoint Filebrowser-Server-IP:PORT/files/{file-name} . While the server correctly handles and stores uploaded files, it attempts to load the entire content into memory during read operations without size checks or resource limits. This allows an authenticated user to upload a large file and trigger uncontrolled memory consumption on read, potentially crashing the server and making it unresponsive.

References

  • github.com/advisories/GHSA-7xqm-7738-642x
  • github.com/filebrowser/filebrowser
  • github.com/filebrowser/filebrowser/issues/5294
  • github.com/filebrowser/filebrowser/security/advisories/GHSA-7xqm-7738-642x
  • nvd.nist.gov/vuln/detail/CVE-2025-53893

Code Behaviors & Features

Detect and mitigate CVE-2025-53893 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

Version 2.38.0

Solution

Unfortunately, there is no solution available yet.

Impact 6.5 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-400: Uncontrolled Resource Consumption
  • CWE-789: Memory Allocation with Excessive Size Value

Source file

go/github.com/filebrowser/filebrowser/v2/CVE-2025-53893.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sun, 25 Jan 2026 00:17:19 +0000.