File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview and edit your files. It is a create-your-own-cloud-kind of software where you can just install it on your server, direct it to a path and access your files through a nice web interface.

Background: Update On File Browser, March 2026.

Published advisories are listed under security advisories, and reporting instructions are in SECURITY.md. Two known issue classes remain unaddressed and will not be fixed:

• Command execution, runner, and hooks. This feature is plagued with vulnerabilities across many published advisories, and would need a full rewrite to be made safe. It is disabled by default; if you re-enable it with --disable-exec=false, treat the ability to run commands as equivalent to shell access on the host. Background: #5199.
• Session and JWT handling. Sessions are self-contained JWTs rather than server-side identifiers, so they cannot be revoked, which means that logout, password changes, and renewal leave previously issued tokens valid until they expire, and the same refresh token can be redeemed repeatedly. Assume a leaked token is valid until expiry. Background: #5216.

If you keep running File Browser, treat it as unmaintained software:

• Do not expose it directly to the internet. Put it behind a reverse proxy that terminates TLS and performs its own authentication.
• Keep the command runner disabled. It is off by default, so leave it off. See #5199 and docs/command-execution.md.
• Run it unprivileged, inside a container, with only the directory you intend to serve mounted into it.

Documentation on how to install, configure, and build this project lives in docs in this repository.

CONTRIBUTING.md documents how to build and develop the project, which remains useful to anyone forking it.

Apache License 2.0 © File Browser Contributors