---
id: CVE-2026-90927
title: >-
  filebrowser through 2.63.23 fails to limit WebSocket message size in the
  /api/command handler before checking permissions, allowing authenticated users
  to buffer arbitrarily large messages
summary: >-
  filebrowser through 2.63.23 fails to limit WebSocket message size in the
  /api/command handler before checking permissions, allowing authenticated users
  to buffer arbitrarily large messages. Attackers can send oversized WebSocket
  messages…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
vendor: filebrowser
product: filebrowser
affected:
  - filebrowser <= 2.63.23
published: '2026-09-14'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:34:34.170'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90927'
references:
  - url: >-
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/filebrowser-through-2.63.23-denial-of-service-via-unbounded-websocket-message
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/filebrowser/filebrowser/security/advisories/GHSA-39cx-23x9-5c8p
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00436
epssPercentile: 0.35231
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-16T14:57:36.614650Z'
ingestedAt: '2026-09-14T15:23:07.430Z'
---

## Overview

filebrowser through 2.63.23 fails to limit WebSocket message size in the /api/command handler before checking permissions, allowing authenticated users to buffer arbitrarily large messages. Attackers can send oversized WebSocket messages to exhaust server heap memory and cause denial of service regardless of EnableExec setting or Execute permission.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.