Description

File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-14T13:19:30.870Z",
  "pubdate": "2026-09-14T13:19:30.870Z",
  "executiveSummary": "File Browser versions up to 2.63.23 are susceptible to a memory exhaustion vulnerability within the subtitle conversion endpoint. The flaw arises from the lack of input validation or memory constraints when processing .srt, .ass, or .ssa subtitle files.\nBy uploading or requesting the conversion of disproportionately large subtitle files, an authenticated attacker possessing download privileges can trigger excessive memory consumption on the host server.\nThis vulnerability is classified as a Denial of Service (DoS) risk, as concurrent requests for resource-intensive conversions can lead to system-wide memory exhaustion, resulting in application instability or process crashes.\nThe attack is limited to authenticated users; however, given the nature of File Browser, legitimate users with access to file management could inadvertently or maliciously trigger this crash. No specialized exploitation tools are required, as the native functionality of the application serves as the attack vector.",
  "technicalDetails": "The vulnerability resides in the subtitle conversion processing logic of File Browser, specifically within the endpoint responsible for transforming subtitle formats (e.g., .srt, .ass, .ssa). The root cause is the absence of a 'MaxFileSize' limit or a streaming-based buffer approach during the read/load operations for incoming subtitle data.\nWhen a user triggers a subtitle conversion, the application reads the entire contents of the target subtitle file into the server's application-layer memory (heap). Because the application lacks a defensive mechanism to reject files exceeding a reasonable threshold, it attempts to allocate memory proportional to the size of the file.\nAn authenticated attacker with download/conversion access can exploit this by initiating concurrent HTTP requests for multiple large subtitle files. Each request forces the application to buffer the entire file into RAM. As these requests stack, the total memory consumption increases linearly, rapidly exceeding available system resources.\nThe attack flow is as follows: 1) The attacker authenticates to the File Browser instance; 2) The attacker identifies or uploads large subtitle files (potentially dummy files containing excessive data); 3) The attacker triggers the conversion endpoint, potentially using automated scripts to launch multiple concurrent requests; 4) The application allocates separate memory buffers for each request; 5) Total memory pressure triggers an Out-of-Memory (OOM) event on the server, causing the service to crash or become unresponsive to legitimate user requests.\nThis vulnerability is particularly impactful in containerized environments with strict memory limits, where an OOM killer event will terminate the File Browser container, resulting in a full service outage. The lack of size validation effectively turns a legitimate file-processing feature into a weaponizable mechanism for system-level DoS. Because the endpoint processes files before performing any complex transformation, the server spends significant CPU and memory cycles attempting to parse the payload, magnifying the impact of the memory exhaustion."
}