Skip to content

Releases: FilebrowserNext/filebrowserNEXT

Release list

File Browser Next v3.0.0-next

File Browser Next v3.0.0-next Latest
Latest

Choose a tag to compare

View all tags
@AnARCHIS12 AnARCHIS12 released this 08 Sep 17:58
v3.0.0-next
0a651f9

File Browser Next is a modern, secure, and actively maintained continuation of the open-source File Browser project.

Official Docker Image (GHCR)

Multi-architecture container image (linux/amd64 and linux/arm64) is available directly on GitHub Container Registry:

docker run -d \
  --name filebrowser \
  --restart unless-stopped \
  -p 8080:80 \
  -v /path/to/your/files:/srv \
  -v /path/to/database:/database \
  ghcr.io/filebrowsernext/filebrowsernext:latest

Docker Compose:

services:
  filebrowser:
    image: ghcr.io/filebrowsernext/filebrowsernext:latest
    container_name: filebrowser
    restart: unless-stopped
    ports:
      - "8080:80"
    volumes:
      - /path/to/your/files:/srv
      - /path/to/database:/database

Automated 1-Liner Installation

Install File Browser Next to your system path automatically:

Linux & macOS

curl -fsSL https://raw.githubusercontent.com/FilebrowserNext/get/main/get.sh | bash
filebrowser -r /path/to/your/files

Windows (PowerShell as Administrator)

iwr -useb https://raw.githubusercontent.com/FilebrowserNext/get/main/get.ps1 | iex
filebrowser -r C:\path\to\your\files

Running in the Background

  • Linux & macOS (Nohup):

    nohup filebrowser -r /path/to/your/files > filebrowser.log 2>&1 &

    Stop with: pkill filebrowser

  • Linux Production Service (Systemd):

    sudo tee /etc/systemd/system/filebrowser.service > /dev/null <<SERVICE
[Unit]
Description=File Browser Next
After=network.target

[Service]
ExecStart=/usr/local/bin/filebrowser -r /path/to/your/files
Restart=on-failure
User=nobody

[Install]
WantedBy=multi-user.target
SERVICE
sudo systemctl daemon-reload && sudo systemctl enable --now filebrowser

  • Windows (Silent Background):

    Start-Process filebrowser -ArgumentList "-r C:\path\to\your\files" -WindowStyle Hidden

    Stop with: Stop-Process -Name filebrowser

Security Architecture Hardening

  • Server-Side Token Revocation: Dedicated persistent BoltDB revocation store with in-memory TTL caching. Logging out immediately revokes the JWT session (POST /api/logout).
  • Targeted Session Invalidation: User credentials changes (password, permissions, username, scope, rules) instantly invalidate active sessions via UpdatedAt timestamp tracking. Cosmetic preference saves (language, theme, view mode) no longer disconnect active users.
  • Brute Force Protection: POST /api/login is rate-limited to 10 attempts per IP per 5-minute window (HTTP 429). Public share password attempts are likewise rate-limited to 10 attempts per IP per share per 5-minute window.
  • Reverse-Proxy-Aware IP Resolution: Proxy forwarding headers (CF-Connecting-IP, X-Real-IP, X-Forwarded-For) are trusted only when the direct TCP connection comes from a private/loopback address (Cloudflare, Caddy, Nginx, Pangolin). Public connections cannot forge headers to bypass rate limiting.
  • Hardened HTTP Security Headers: Global inclusion of X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and Permissions-Policy disabling camera, microphone, and geolocation.
  • Command Runner Confinement: Working directory strictly confined within user scope via filepath.Rel. Dangerous shell metacharacters and chaining primitives are blocked for non-admin executions.
  • Single-Use Token Renewal: Reissuing session tokens revokes the previous token ID (jti) to prevent token replay attacks.
  • Strict Error Handling: Tokens referencing deleted users return 401 Unauthorized instead of internal server errors.

Usability & Bug Fixes

  • Case-Insensitive Authentication: Username lookup at login is now case-insensitive. Entering Admin or ADMIN correctly authenticates as admin.
  • Login Whitespace Sanitization: Automatically trims leading and trailing whitespace on the login form.
  • Preserved User Sessions on Settings Update: Fixed the legacy bug where changing language or display preferences invalidated the user token.

Modern UI & Experience

  • Design System Redesign: Modern indigo and slate color tokens, soft multi-layer box shadows, and 8px/12px/16px rounded borders.
  • Glassmorphic Navigation: Blur backdrops (backdrop-filter: blur(16px)) on top navigation bars, action bars, modals, and file selection docks.
  • Redesigned Login Page: Card layout with ambient mesh gradients and responsive styling.
  • New Logo & Visual Identity: Vibrant vector logo in indigo-to-cyan gradient.
  • Modernized File Views: Polished grid cards, clean list rows, and smooth hover elevations.

Downloads & Checksums

OS / Architecture Archive
Linux x86_64 filebrowser-linux-amd64.tar.gz
Linux ARM64 / Raspberry Pi filebrowser-linux-arm64.tar.gz
macOS Intel filebrowser-darwin-amd64.tar.gz
macOS Apple Silicon (M1/M2/M3/M4) filebrowser-darwin-arm64.tar.gz
Windows 64-bit filebrowser-windows-amd64.zip

Verify archive integrity using checksums.txt (SHA256).

Access the web UI at http://127.0.0.1:8080 (or http://<your-server-ip>:8080) — default credentials: admin / admin.

Assets 8
Loading