File Browser versions prior to 2.45.2 are affected by a critical vulnerability related to HTTP request/response smuggling. This issue arises from the use of the Go standard library net/http package, which improperly accepts a bare line feed (LF) as a line terminator in chunked transfer encoding chunk-size lines. This flaw can allow an attacker to perform HTTP request smuggling when File Browser is used with another server that also incorrectly accepts bare LF in chunk extensions. The vulnerability has a high CVSS score of 9.1 and is fixed in version 2.45.2.