GitHub Advisoryadvisory · Go

GHSA-6jqf-mv7m-3q7p File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency

CRITICAL Published 2025-11-13 Modified 2025-11-17 Official page ↗
Ecosystem
Go
Packages
github.com/filebrowser/filebrowser/v2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-1395
Reviewed
2025-11-13

Affected packages

• Go github.com/filebrowser/filebrowser/v2: < 2.45.2 → fixed in 2.45.2

Description

The standard library `net/http` package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.

Related

Weakness · CWE (1)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness

References