CVE-2026-82235

COMPONENT VERSION RANGE

NewScan fingerprints FileBrowser from its response and reports this CVE when the detected version falls inside the affected range below.

MEASURED 2026-08-28 against filebrowser/filebrowser v2.63.23 on loopback. The version is captured IN-BAND by the tech_signatures "FileBrowser" row out of the window.FileBrowser bootstrap object on /, so this row costs no request of its own - the same path the 2026-08-14 row below uses. NO `fixed_in` AND NO `lt`, WHICH IS THE POINT OF THIS ROW: GHSA-8q5j-8wcr-8v2v states the patched version is 'None' because the project is no longer maintained and no fix will ship, so there is no upgrade boundary to write and `le` is the only honest operator. Every other known_vulns row in this pack says 'upgrade to X'; this one cannot, and an assessor reading it needs to know the remediation is to migrate off the product or to put it behind something that terminates the request. CVE-2026-82235 (8.2): the directory-archive and public-download handlers do not check the file type before opening, so a named pipe (FIFO) planted in a shared directory makes the open() block forever - an authenticated user parks a handler thread per request and a public share turns it into an unauthenticated one. CVE-2026-82237 (2.3): share records are keyed by path and only deletion cleans them up, so renaming a shared file leaves the old share serving whatever later takes that path. Both are 'through 2.63.23', the newest release. VERSION-MATCH ONLY: confirming the DoS in-band means hanging a stranger's file server, which reproduce-before-record does not license, and confirming the stale share means writing to their storage. CVE-2026-82238 from the same batch is a separate row below, because its affected floor is 2.24.0.