Note
Active fork. Upstream filebrowser/filebrowser was archived on 2026-09-01; v2.63.23 was its final release. This fork continues maintenance: bug fixes and the upstream security backlog first. Releases are tagged from v2.63.24 onward; bug reports are welcome in issues.
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview and edit your files. It is a create-your-own-cloud-kind of software where you can just install it on your server, direct it to a path and access your files through a nice web interface.
Background: Goodbye File Browser, for Real This Time, July 2026.
Advisories inherited from upstream are tracked with their fix status in SECURITY-BACKLOG.md. Reporting instructions are in SECURITY.md; regular bugs go to issues.
Two issue classes upstream left unfixed, and where this fork stands on them:
- Command execution, runner, and hooks. Upstream considered this area unsafe by design and kept it disabled by default; if you re-enable it with
--disable-exec=false, treat the ability to run commands as equivalent to shell access on the host. This fork fixed hooks being silently skipped when exec is disabled (v2.63.24) and is working through the runner-related advisories in the backlog. Background: #5199. - Session and JWT handling. Sessions are self-contained JWTs rather than server-side identifiers, so they cannot be revoked, which means that logout, password changes, and renewal leave previously issued tokens valid until they expire, and the same refresh token can be redeemed repeatedly. Token invalidation advisories are on the backlog; until they are fixed, assume a leaked token is valid until expiry. Background: #5216.
While the backlog is open, the upstream hardening advice still applies:
- Do not expose it directly to the internet. Put it behind a reverse proxy that terminates TLS and performs its own authentication.
- Keep the command runner disabled. It is off by default, so leave it off. See #5199 and
docs/command-execution.md. - Run it unprivileged, inside a container, with only the directory you intend to serve mounted into it.
Documentation on how to install, configure, and build this project lives in docs in this repository.
CONTRIBUTING.md documents how to build and develop the project, which remains useful to anyone forking it.
Apache License 2.0 © File Browser Contributors