CVE-2026-82235: Filebrowser Named Pipe DoS Vulnerability

CVE-2026-82235 Overview

CVE-2026-82235 is a denial-of-service vulnerability in filebrowser through version 2.63.23. The application fails to validate named pipes (FIFOs) inside directories processed by the archive and public download handlers. When a request triggers a read of a named pipe, the underlying open syscall blocks indefinitely, pinning the handling goroutine and consuming server connection resources. Authenticated users and anonymous visitors with access to public share links can trigger the flaw. The issue is tracked as CWE-400: Uncontrolled Resource Consumption.

Critical Impact
Repeated requests to archive endpoints containing named pipes exhaust server goroutines and connections, rendering the filebrowser service unavailable to legitimate users.

Affected Products

filebrowser through 2.63.23
Deployments exposing public share links to anonymous visitors
filebrowser instances with authenticated user accounts having write access to shared directories

Discovery Timeline

2026-08-28 - CVE-2026-82235 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82235

Vulnerability Analysis

The defect lives in filebrowser's file handling logic. When the archive handler walks a directory to build a zip or tar stream, or when the public download handler serves a file, it opens each entry without checking whether the entry is a regular file. A named pipe (FIFO) on POSIX systems blocks on open until a writer is available. Because filebrowser is written in Go and handles each request in a goroutine, every blocked call pins a goroutine and holds an open HTTP connection. An attacker who can place or reference a named pipe inside a served directory can issue repeated archive or download requests to accumulate blocked goroutines. This exhausts the process's file descriptor and connection limits, producing a denial-of-service condition.

Root Cause

The file metadata detection routine in files/file.go invoked os.Open on entries whose mode indicated a named pipe. The code path lacked a type check for os.ModeNamedPipe before reading the file, allowing the blocking syscall to reach the kernel.

Attack Vector

The vulnerability is exploitable over the network. An attacker with a valid session, or any visitor holding a public share URL, requests an archive of a directory containing a named pipe. Each request stalls indefinitely and cannot be canceled server-side. Sending a small number of concurrent requests is sufficient to exhaust the goroutine pool.

// Patch in files/file.go - fix hanging when reading a named pipe file (closes #1155)
//nolint:goconst
//TODO: use constants
func (i *FileInfo) detectType(modify, saveContent bool) error {
	if IsNamedPipe(i.Mode) {
		i.Type = "blob"
		return nil
	}
	// failing to detect the type should not return error.
	// imagine the situation where a file in a dir with thousands
	// of files couldn't be opened: we'd have immediately

Source: filebrowser commit 586d198d

The fix short-circuits detectType when the entry's mode reports a named pipe, tagging the file as an opaque blob and skipping the blocking open call. A companion change in files/utils.go imports the os package to expose the os.ModeNamedPipe bit used by the new IsNamedPipe helper.

Detection Methods for CVE-2026-82235

Indicators of Compromise

Long-lived HTTP requests to filebrowser archive endpoints (for example /api/raw with algo=zip) that never return a response body.
Rapid growth in the filebrowser process's goroutine count or open file descriptor count without a matching increase in completed requests.
Presence of named pipe (FIFO) entries inside directories exposed through user shares or public share links.

Detection Strategies

Inspect served directories for entries where the file mode includes the p (named pipe) bit, using find <shared-path> -type p.
Correlate access logs for repeated archive or download requests from the same source IP or share token that exceed normal response times.
Monitor for HTTP client disconnects paired with server-side goroutines that remain active handling the abandoned request.

Monitoring Recommendations

Emit metrics for active goroutines and open connections from the filebrowser process and alert on sustained upward trends.
Log and alert on requests to archive and public-share endpoints whose duration exceeds a defined threshold.
Enable filesystem auditing on directories exposed by filebrowser to detect the creation of FIFO nodes via mkfifo.

How to Mitigate CVE-2026-82235

Immediate Actions Required

Upgrade filebrowser to a release that includes commit 586d198d or later, which is the version following 2.63.23.
Audit all directories referenced by filebrowser configurations and remove any named pipes that do not belong there.
Restrict or disable anonymous public share links until the upgrade has been applied.

Patch Information

The upstream fix is delivered in filebrowser commit 586d198d and documented in GitHub Security Advisory GHSA-8q5j-8wcr-8v2v. Additional technical context is available in the VulnCheck Filebrowser DoS Advisory. The patch adds an IsNamedPipe check in files/file.go so the archive and download paths no longer invoke open on FIFO entries.

Workarounds

Place filebrowser behind a reverse proxy that enforces short request timeouts for archive and download endpoints.
Run filebrowser with a strict ulimit on open files and goroutine counts, and configure automatic restart on saturation.
Set share roots to directories that are scanned regularly for non-regular files, and reject shares whose contents include FIFOs, sockets, or device nodes.

bash

# Scan a filebrowser share root for named pipes before publishing it
find /srv/filebrowser/data -type p -print

# Remove any FIFO entries that are not required
find /srv/filebrowser/data -type p -delete

# Example nginx reverse proxy timeout for archive endpoints
# proxy_read_timeout 15s;
# proxy_send_timeout 15s;