GHSA-6jqf-mv7m-3q7p

Source

https://github.com/advisories/GHSA-6jqf-mv7m-3q7p

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/11/GHSA-6jqf-mv7m-3q7p/GHSA-6jqf-mv7m-3q7p.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6jqf-mv7m-3q7p

Aliases

GO-2025-4118

Published

2025-11-13T22:36:01Z

Modified

2025-11-17T21:50:44Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency

Details

The standard library net/http package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.

Database specific

{
    "github_reviewed_at": "2025-11-13T22:36:01Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1395"
    ],
    "nvd_published_at": null,
    "severity": "CRITICAL"
}

References

Affected packages

Go / github.com/filebrowser/filebrowser/v2

Package

Name: github.com/filebrowser/filebrowser/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/filebrowser/filebrowser/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.45.2

Database specific

last_known_affected_version_range

"<= 2.45.1"