Open-source package vulnerability · Go

GHSA-6jqf-mv7m-3q7p: File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency

criticalCVSS 3.1 9.1

The standard library net/http package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext. See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.

Published Nov 13, 2025

Affected packages

github.com/filebrowser/filebrowser/v2

Ecosystem: Go
Affected: <= 2.45.1
Fixed in: 2.45.2
Check: go list -m github.com/filebrowser/filebrowser/v2

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

The standard library net/http package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.

See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.

Credited to Francesco-Bellomi, hacdias.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More Go vulnerabilities

All Go entries