Description

filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking open syscalls. Authenticated users or anonymous visitors with public share links can repeatedly request archives containing named pipes to pin server goroutines and exhaust connection resources.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-28T12:16:33.267Z",
  "pubdate": "2026-08-28T12:16:33.267Z",
  "executiveSummary": "The Filebrowser application, spanning versions through 2.63.23, is susceptible to a denial-of-service vulnerability due to improper validation of filesystem objects within archive and public download handlers.\nThis vulnerability allows both authenticated users and anonymous visitors with public share links to trigger blocking open syscalls by including named pipes (FIFOs) in requested archives.\nThe exploitation of this flaw leads to the pinning of server goroutines, which subsequently exhausts available connection resources and stalls the application's request processing capabilities.\nThe primary risk is a targeted denial-of-service attack, where a malicious actor can render the application unresponsive by consuming server-side execution threads.\nSuccessful exploitation does not require administrative privileges, as the functionality is accessible via standard public share links, making the attack surface significantly broad and easily reachable.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient sanitization and validation logic implemented within the Filebrowser's archive generation and public download handler components. When a user initiates a download or archive request for a directory, the application recursively traverses the target filesystem path to bundle the files.\nIn systems where Filebrowser operates on a filesystem containing named pipes—typically encountered in Unix-like environments—the application fails to distinguish between standard files and special filesystem objects like FIFOs. When the handler attempts to include a named pipe in an archive or stream it via the public download interface, it executes an open() syscall on the object.\nIn the context of named pipes, the open() system call is inherently blocking until both ends of the pipe are connected. Because Filebrowser uses a concurrency model based on goroutines, each request triggers a new goroutine to handle the IO operation. By repeatedly requesting an archive containing these named pipes, an attacker can cause a surge in blocked goroutines. Since these threads remain trapped in a wait state awaiting pipe synchronization that never occurs, the application quickly reaches its resource limit for concurrent connections.\nThe attack flow is straightforward: 1) The attacker identifies a directory accessible via the interface that contains or allows the creation of a named pipe. 2) The attacker issues an HTTP request to the archive or download endpoint targeting the directory or the pipe directly. 3) The server-side code performs an open() operation on the named pipe, which blocks the handling goroutine indefinitely. 4) The attacker repeats this process until the server's thread/goroutine pool is exhausted, resulting in a persistent state of resource starvation where legitimate requests are dropped or queued indefinitely, effectively taking the service offline.\nThe vulnerability is prevalent in all versions up to 2.63.23. The exposure is heightened by the fact that this can be triggered anonymously through public share links, effectively bypassing any authentication-based security controls that might otherwise limit malicious actors."
}