filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger blocking… (CVE-2026-82235)

filebrowser through version 2.63.23 fails to validate named pipes in directory archive and public download handlers. This vulnerability enables attackers to trigger blocking open syscalls by requesting archives containing named pipes. Both authenticated users and anonymous visitors with public share links can exploit this to pin server goroutines and exhaust connection resources, leading to denial of service conditions. The CVSS v3.1 score is 5.9 with an attack vector of network, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, and high availability impact. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption). No patch or remediation information is provided in the source data.

The vulnerability allows denial of service by exhausting server connection resources through repeated requests of archives containing named pipes. This can degrade or disrupt service availability for legitimate users. There is no impact on confidentiality or integrity reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to public share links or limit archive requests containing named pipes if possible to mitigate resource exhaustion.