VULNERABILITY INTELLIGENCE
CVE-2026-90927
CVSS score6.5 MEDIUM
EPSS probability0.44%
CISA KEVNot currently listed
Published2026-09-14
Last modified2026-09-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Description
filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.
Weakness classification
- disclosure@vulncheck.com: CWE-400