File Browser is a web‑based file manager that allows users to upload, delete, preview, rename and edit files. The vulnerability resides in its public login API, which accepts an unchecked password field. When an attacker supplies an extraordinarily large password, the server consumes excessive CPU and memory resources, leading to severe latency, crashes and, in containerized environments, even propagating faults to the host daemon. The flaw satisfies CWE‑400 (Uncontrolled Resource Consumption) and CWE‑1284 (Improper Reconstruction of Input).

The flaw affects installations of File Browser v2.63.5 and earlier, regardless of deployment mode, including Docker containers and bare‑metal hosts. The upstream project recommends upgrading to v2.63.6 or later to receive the input‑validation patch.

The CVSS score of 6.5 classifies this as a medium‑severity flaw. No EPSS data is available, so the likelihood of exploitation cannot be quantified, and the vulnerability is not yet listed in CISA’s KEV catalog. Attackers can exploit it remotely by issuing oversized password strings to the publicly exposed login endpoint; the payload can be crafted with any network access to the container or host, triggering DoS without needing further privileges.