Medium severity6.5NVD Advisory· Published Sep 14, 2026
CVE-2026-90927
CVE-2026-90927
Description
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<=2.63.23+ 1 more
- (no CPE)range: <=2.63.23
- (no CPE)range: <=2.63.23
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.