HIGH 7.1 NVD
CVE-2026-90928
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.
References
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-448h-jr2h-3vhp
- https://www.vulncheck.com/advisories/file-browser-through-2.63.23-memory-exhaustion-via-su
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-448h-jr2h-3vhp
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-09-14 via NVD.
vulnfeed aggregates 10822 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.