Mirrors/filebrowser
1
0
Fork 0
mirror of https://github.com/filebrowser/filebrowser.git synced 2026-07-29 18:50:33 +00:00
Code Issues Projects Releases Wiki Activity

docs: include issue summary in readme

Browse source
This commit is contained in:
Henrique Dias 2026-07-27 22:04:46 +02:00
parent e8a388f840
commit 1cd18d7ead
No known key found for this signature in database
1 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

8
README.md
View file

@ -12,10 +12,12 @@ File Browser provides a file managing interface within a specified directory and
## Security
Published advisories are listed under [security advisories](https://github.com/filebrowser/filebrowser/security/advisories), and reporting instructions are in [SECURITY.md](SECURITY.md). This project has known security issue classes that remain unaddressed and will not be fixed:
Published advisories are listed under [security advisories](https://github.com/filebrowser/filebrowser/security/advisories),
and reporting instructions are in [SECURITY.md](SECURITY.md). Two known issue classes
remain unaddressed and will not be fixed:
- **Command execution, runner, and hooks** (opt-in, disabled by default, [#5199](https://github.com/filebrowser/filebrowser/issues/5199))
- **Session and JWT handling** ([#5216](https://github.com/filebrowser/filebrowser/issues/5216))
- **Command execution, runner, and hooks.** This feature is plagued with vulnerabilities across many published advisories, and would need a full rewrite to be made safe. It is disabled by default; if you re-enable it with `--disable-exec=false`, treat the ability to run commands as equivalent to shell access on the host. Background: [#5199](https://github.com/filebrowser/filebrowser/issues/5199).
- **Session and JWT handling.** Sessions are self-contained JWTs rather than server-side identifiers, so they cannot be revoked, which means that logout, password changes, and renewal leave previously issued tokens valid until they expire, and the same refresh token can be redeemed repeatedly. Assume a leaked token is valid until expiry. Background: [#5216](https://github.com/filebrowser/filebrowser/issues/5216).
If you keep running File Browser, treat it as unmaintained software: