v2.63.26

Third maintenance release of this fork. It clears the remaining seven advisories from the upstream backlog: all 30 published advisories are now resolved — 10 fixed by this fork (v2.63.25 and v2.63.26), 19 inherited from upstream's final releases, 1 mitigated by upstream's startup warning. Per-advisory status: SECURITY-BACKLOG.md.

Security fixes

• GHSA-39cx-23x9-5c8p — command websocket buffers unbounded messages. The handler now rejects a connection that can never run a command before reading anything the client sends, and bounds the message size (1 MiB) for authorized connections. Previously any authenticated user could make the server buffer an arbitrarily large message before the rejection.
• GHSA-7w29-q235-57m9 — symlink aliases bypass path deny rules. When a request path crosses a symbolic link, the rules are now also checked against the resolved target, so an in-scope alias cannot bypass a deny rule written for the target. The re-check only fires when the path actually crosses a symlink, so case normalization on case-insensitive filesystems does not widen any rule.
• GHSA-8q5j-8wcr-8v2v — archive downloads hang on named pipes. Archives now skip special files (named pipes, sockets, devices), and single-file downloads — including public shares pointing directly at a pipe — serve headers only instead of opening the pipe, which blocks until a writer attaches.
• GHSA-v7vv-5wj2-gfcj — password reset does not invalidate sessions. A per-user token epoch is now persisted and bumped on every password change; tokens issued before the change no longer authenticate. Resetting a password evicts the sessions minted under the old one.
• GHSA-r6pg-pg54-rcr5 — deleting another user's shared file leaves their link. Deletes now remove every share that pointed at the deleted path or one of its descendants, resolved through each owner's scope. Shares whose scope-relative path merely collides from a different scope still survive.
• GHSA-m8v4-4w34-rrvf — renaming a shared file leaves the link. Renames now remove the shares pointing at the old path, so an old link cannot silently serve whatever file later appears there.
• GHSA-4r8p-gqj2-mwgm — concurrent TUS uploads exceed the declared length. PATCH requests on the same upload are now serialized, so racing requests can no longer both pass the offset check and both append, leaving the file a multiple of its declared Upload-Length.

Each fix ships with a regression test reproducing the advisory's proof of concept.

Binaries

linux-amd64, linux-arm64, windows-amd64, darwin-amd64, darwin-arm64 — static (CGO disabled), frontend embedded.

v2.63.25

Second maintenance release of this fork. It fixes the three high-severity advisories upstream left unfixed, and completes a full audit of the 30-advisory upstream backlog: every other advisory was verified as already fixed (or mitigated) in the v2.63.23 baseline this fork started from. Per-advisory status: SECURITY-BACKLOG.md.

Security fixes

• GHSA-448h-jr2h-3vhp / CVE-2026-90928 — subtitle conversion memory exhaustion. The subtitle endpoint now rejects files larger than 10 MB before reading them, matching the cap that bounds the text-content path. Previously an authenticated user could request conversion of an oversized subtitle file and make the server allocate several times its size.
• GHSA-c4fr-5f24-4wrj / CVE-2026-90929 — upload failure-cleanup wipes directories. Uploads aimed at an existing directory are now rejected with 400, and the failure cleanup only removes files the request itself created (non-recursive). Previously a POST ?override=true aimed at a directory failed inside the write, and the cleanup then recursively deleted the whole tree — bypassing Perm.Delete and deny rules.
• GHSA-8c9q-7855-wfxq / CVE-2026-54090 — command allowlist bypass via shell metacharacters. When a shell is configured, user commands containing shell metacharacters (;, |, &, $, backticks, (, ), <, >, line breaks) are rejected. Previously the whole raw command string was handed to the shell after only its first token was checked against the per-user allowlist, so ls; id ran both. Admin-configured hooks are unaffected.

Each fix ships with a regression test reproducing the advisory's proof of concept.

Backlog audit

The remaining 27 advisories from the upstream archive were audited:

• 19 were already fixed by upstream before v2.63.23 — verified in this fork's code (the fixes and their regression tests are present in the baseline).
• 1 (critical, GHSA-6759-996p-gpj6) was mitigated by upstream with a startup warning; this fork inherits it.
• 7 remain open in this fork (4 medium, 3 low), tracked in SECURITY-BACKLOG.md for a future release.

Binaries

linux-amd64, linux-arm64, windows-amd64, darwin-amd64, darwin-arm64 — static (CGO disabled), frontend embedded.

v2.63.24

Community continuation of Filebrowser — upstream archived on 2026-08-31 with no further releases or security fixes. This fork picks up maintenance.

What's fixed in v2.63.24

• Hooks run regardless of EnableExec: before_*/after_* hook commands configured in Global Settings were silently skipped when the user-facing shell exec feature was disabled (EnableExec=false). No log, no error — hooks simply never fired, which made the misconfiguration nearly impossible to diagnose. The Runner.Enabled field that gated them existed solely for this purpose and has been removed. The user-facing exec feature is unaffected (it still requires EnableExec plus per-user execute permission). A regression test (TestResourcePostRunsHooksWhenExecDisabled) locks in the new behavior.

Binaries

Core platforms for this release: linux-amd64, linux-arm64, windows-amd64, darwin-amd64, darwin-arm64. If you rely on another platform from the upstream matrix (386, armv5/6/7, riscv64, freebsd, openbsd), open an issue and it will be included in the next release.