PT-2026-49065 · Unknown · Filebrowser
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
File Browser versions prior to 2.63.6
Description
Lack of maximum length validation for passwords allows an arbitrarily large string to be passed into the login API. When a large password is submitted, the
CheckPwd() function in users/password.go attempts to hash the input, causing spikes in CPU and memory usage. This can lead to severe system lag, container crashes, and may cause the Docker daemon to return 500 status code errors even after the affected container is destroyed. The issue occurs when sending JSON in the request body to the api/login endpoint using the password variable.Recommendations
Update to version 2.63.6.
Exploit
Fix
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Filebrowser