Technical impact
filebrowser through version 2.63.23 does not validate the size of WebSocket messages received by the /api/command endpoint before performing permission checks. As a result an authenticated user can submit arbitrarily large messages that fill the server’s memory, leading to a denial of service. This uncontrolled resource consumption is attributed to CWE‑400. The flaw can be exploited regardless of the EnableExec setting or Execute permission, making any authenticated session a potential vector for outage.
Affected Systems
All instances of the filebrowser filebrowser product that are running any release from the initial release up to and including 2.63.23 are susceptible. Identified by the vendor product name filebrowser; the version range includes every installation lower than 2.63.24.
Risk and Exploitability
The CVSS base score of 7.1 flags the vulnerability as high‑severity, indicating significant impact on availability. The EPSS score is not available, so the likelihood of exploitation remains uncertain but could be high given the simplicity of sending large WebSocket frames. The vulnerability is not listed in CISA KEV, and no publicly reported exploits have been documented. An attacker with authenticated credentials can issue a WebSocket message with a payload size that exceeds the server’s memory limit, which will allocate heap space until exhaustion, causing the service to crash or become unresponsive. The attack is remote and does not require special network conditions beyond normal WebSocket access.
