File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency

published 2025-11-13 last yr. modified 2026-03-03 8mo ago also GO-2025-4118

cvss: 9.1; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

The standard library `net/http` package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.

Patch / fix

fixed in 1

go github.com/filebrowser/filebrowser/v2 2.45.2

Is GHSA-6jqf-mv7m-3q7p in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/filebrowser/filebrowser/v2	<2.45.2	2.45.2
go	github.com/filebrowser/filebrowser	all versions	no fix listed

Classification

Weakness

CWE-1395 Dependency on Vulnerable Third-Party Component

References

github.com /filebrowser/filebrowser/security/advisories/GHSA-6jqf-mv7m-3q7p
web, advisory
nvd.nist.gov /vuln/detail/CVE-2025-22871
advisory, web
github.com /filebrowser/filebrowser
package

Sources

GitHub Advisory GHSA-6jqf-mv7m-3q7p
OSV GO-2025-4118

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.