No version receives security fixes. The last planned release has already shipped and no further changes will be merged.

This project is being wound down. To avoid duplicates, first check the existing advisories and open issues, and confirm:

• It concerns this project, not a fork. Reports about code, features, or endpoints that don't exist here belong to the relevant fork.
• It isn't an already-known class that remains unaddressed. Those are listed under Security in the README; reports covering them are likely to be closed as duplicates.

Until 2026-09-01, report privately via the Security page. After that date this repository is read-only and reports can no longer be submitted.

Please include, where possible:

• The commit the issue was found at
• A plaintext proof of concept (no binaries)
• Steps to reproduce
• Recommended remediation, if any

No fix will ship for any report: the last planned release has already shipped and no further changes will be merged. Reports may still be published as advisories so that people running File Browser can assess their exposure.