Security Digest · Critical advisory (no CVE assigned)
GHSA-6jqf-mv7m-3q7p: File Browser has risk of HTTP Request/Response smuggling through vulnerable dependency
The standard library net/http package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/filebrowser/filebrowser/v2 | <= 2.45.1 | 2.45.2 |
Details
The standard library net/http package dependency used by File Browser improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. I can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
See https://nvd.nist.gov/vuln/detail/CVE-2025-22871 for more details.
CVSS: 9.1 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Sources and references
- GitHub Advisory GHSA-6jqf-mv7m-3q7p github.com
- github.com github.com
- nvd.nist.gov nvd.nist.gov