Description

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T13:19:30.710Z",
  "pubdate": "2026-09-14T13:19:30.710Z",
  "executiveSummary": "The vulnerability is a resource exhaustion flaw located within the Filebrowser API handler. It exists in versions up to 2.63.23 and specifically impacts the /api/command WebSocket implementation.\nThe issue stems from a failure to enforce message size constraints prior to performing permission validation. Consequently, an authenticated attacker can transmit excessively large WebSocket payloads, forcing the server to allocate significant heap memory for processing.\nThis vulnerability is critical because it bypasses application-level security controls, such as the 'EnableExec' configuration and specific user 'Execute' permissions. By repeatedly sending oversized frames, an attacker can trigger uncontrolled memory growth, leading to heap exhaustion and a subsequent denial of service (DoS) state.\nThe attack is remotely exploitable over the network by any authenticated user, regardless of their authorization level, posing a significant risk to the availability and stability of the Filebrowser service.",
  "technicalDetails": "The root cause of this vulnerability is an improper input validation sequence within the /api/command WebSocket handler in Filebrowser. The application architecture initiates the handling of incoming WebSocket frames before confirming the security context of the requester. Specifically, the buffer allocation mechanism lacks a pre-validation check against the size of the incoming payload.\nIn the affected versions (through 2.63.23), the WebSocket endpoint processes frames without verifying the payload constraints. When an authenticated user initiates a connection to /api/command, the server allocates heap space to buffer the incoming data stream. Because the check for 'Execute' permissions or the 'EnableExec' global flag occurs after the buffer allocation logic, the server is forced to hold the malicious payload in memory even if the request would eventually be denied due to lack of administrative privileges.\nThe exploitation flow proceeds as follows: 1) The attacker establishes a WebSocket connection to the /api/command endpoint. 2) The attacker sends a series of exceptionally large, continuous WebSocket messages. 3) The server-side handler, failing to enforce a maximum message size policy, attempts to buffer these messages in the process heap. 4) The heap consumption continues to grow with each concurrent or sequential request, leading to severe memory pressure.\nThis sequence effectively bypasses existing security hardening measures. Even if an attacker lacks the necessary 'Execute' role or if the system administrator has disabled command execution features, the memory allocation logic remains vulnerable. Continued exploitation results in the exhaustion of available system memory, leading to an OOM (Out of Memory) condition or significant performance degradation, which constitutes a successful denial of service attack against the entire Filebrowser process.\nThe vulnerability is limited to authenticated sessions, but because it functions independently of higher-level authorization checks, it exposes the underlying runtime environment to resource depletion from any user with basic access privileges to the platform."
}