CVE-2026-90928 in File Browser
Summary
by MITRE • 09/14/2026
File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files into memory without size limits. Authenticated attackers with download permission can request conversion of large .srt, .ass, or .ssa files and exhaust server memory through concurrent requests, causing denial of service.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/14/2026
The identified security flaw resides within the File Browser application, specifically affecting versions up to 2.63.23, in its subtitle processing subsystem. This component is responsible for handling various subtitle formats including .srt, .ass, and .ssa files during conversion operations. The core technical deficiency lies in the absence of input validation regarding file size limits when loading these documents into system memory. Instead of implementing streaming mechanisms or chunked reading strategies that process data incrementally, the application attempts to load the entirety of a subtitle file into RAM simultaneously upon receiving a conversion request. This architectural decision creates a direct pathway for resource exhaustion attacks because there are no constraints on the volume of data accepted from client inputs prior to memory allocation.
From an operational perspective, this vulnerability enables authenticated attackers who possess download permissions to trigger a denial of service condition against the server infrastructure. By crafting and submitting requests containing exceptionally large subtitle files, an attacker can force the application to allocate excessive amounts of random access memory for each concurrent request. When multiple such requests are processed in parallel, either through automated tools or distributed attack vectors, the cumulative memory consumption rapidly exceeds available system resources. This leads to severe performance degradation, eventual crash of the application process, and potential instability of other services running on the same host due to resource starvation. The impact is strictly limited to availability as it does not permit arbitrary code execution or direct data exfiltration beyond what was already accessible via legitimate download permissions.
This vulnerability aligns with Common Weakness Enumeration category CWE-400 which describes uncontrolled resource consumption, specifically manifesting here as a memory exhaustion scenario. In the context of the MITRE ATT&CK framework, this behavior corresponds to techniques associated with Denial of Service attacks where adversaries aim to disrupt service availability rather than compromise confidentiality or integrity. The attack vector requires authentication and specific file system permissions, which classifies it primarily as an internal threat that could be exploited by malicious insiders or compromised user accounts within the organization's network perimeter.
Mitigation strategies should prioritize immediate patching to version 2.63.24 or later where this issue has been resolved through implementation of strict size limits and streaming processing logic. In environments where upgrading is not immediately feasible, administrators can implement web application firewall rules to restrict the maximum payload size for subtitle conversion endpoints effectively blocking oversized files before they reach the vulnerable code path. Additionally, deploying resource monitoring alerts that trigger on abnormal memory usage spikes related to file upload or conversion services can provide early detection capabilities. Ensuring that service accounts have minimal necessary privileges further reduces the blast radius should an attacker successfully exploit this flaw by limiting their ability to access large media libraries for weaponization.