github.com/gtsteffaniak/filebrowser

Security:

• Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse) GHSA-r633-fcgp-m532
• Patched Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info GHSA-525j-95gf-766f

New Features:

• More user options for settings (#2072) (#2067):
  • Option to disable thumbnails userDefaults.preview.audio and userDefaults.preview.models for Audio and 3D Models.
  • Option to disable files in the Tree navigation userDefaults.hideFilesInTree
  • Option to disable source files deletion when creating/extracting archives. userDefaults.deleteAfterArchive

Notes:

• Share icon does not show in share listing or for shares for other users.
• File Size Analyzer tool max items increased from 100 to 200.
• changed symlink detection logic.

BugFixes:

• 405 response code error on Webdav in 1.3.0-beta (#2054)
• Motion Preview setting not saving when changed in profile settings.
• Context menu on tools not working.

Note: a potentially breaking change for docker users: \the default user is now "filebrowser" 1000:1000 instead of root.

New Features:

• New Sidebar Features
  • Sidebar tree navigation (#2006) (#350)
  • Source usage to be customized to show os-reported values rather than calculated. This can be changed per source by editing the source link in the sidebar. (#1266) (#982)
• Archive/Unarchive actions in UI (#1252) (#335) (#1569)
  • new api to archive/unarchive files on the server
  • requires create user permissions
  • archiving actions respect server.maxArchiveSize
• Added share icon to items that are shared (#1420)
• Authentication enhancements
  • LDAP login support with OIDC feature parity. (#591)
  • userGroup for OIDC and LDAP, only users in a group will get access. (#1964)
  • Add JWT token authentication support (#1364)
• Enhanced thumbnail and item previews
  • Added ability to show "motion preview" for folders with multiple child items that have previews. cycles through the first 4 images.
  • support for reading embedded images from raw image or heic/heif files (#215)
  • reorganized and simplified thumbnail settings in profile settings (#1968)
  • removed highQuality thumbnail option which only affected gallery view. Now its always enabled.
  • improved caching for unsupported images, the same file won't be attempted again with the same modtime.
  • supports 3d model previews.
• FileWatcher also supports watching directories
• Support previews for 3D model files (STL, OBJ, 3MF, etc.) (#1273)
  • supported formats via threejs: GLTF, GLB, OBJ, STL, PLY, DAE (Collada), 3MF, 3DS, USDZ, USD, USDA, USDC, AMF, VRML, WRL, VTK, VTP, PCD, XYZ, VOX, KMZ
  • supports animations (for formats that contain them)
  • supports embedded textures, external neighboring file textures, or textures in /textures subdirectory
• Enhanced prompts
  • All prompts have a taskbar with a close button
  • Prompts can be freely moved by dragging taskbar
  • Prompt styling has been updated
  • Clicking outside of prompts no longer automatically closes them.
• add webdav support (#209) -- thanks to @reddac for (#1764)
  • see docs on how to use
  • requires api an un-customized api token as password
  • respects access rules
  • requires download permission to view and modify/create/delete permission to modify.

Notes:

• Docker images default to filebrowser user instead of root
• reorganized api routes
  • consolidated tags for swagger to be more accurately grouped
  • tools are all behind /api/tools routes
  • /api/raw is deprecated (but functional). The /api/resources/download route will be used instead.
  • /api/preview has been removed and replaced with /api/resources/preview
  • /api/onlyoffice have been replaced with /api/office
  • /api/shares has been moved to /api/share/list
  • /api/auth/tokens has been moved to /api/auth/token/list and /api/auth/token added to get specific token info
  • PUT /api/token has been moved to POST /api/token
  • /public/api/shareinfo has been moved to /public/api/share/info
  • POST /resources/bulk/delete api has been moved to DELETE /resources/bulk (#1984)

BugFixes:

• Long folder names get cut off at top navigation bar (#1934)

BugFixes:

• head > title > infinitely duplicating titles (#2016)
• Proxy auth not working with Nginx, stuck at logo (#2013)

Security:

• resolves https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6

Notes:

• Dependency Updates for frontend and backend packages
• Upgrade to go 1.26
• file list prompt interaction behavior, single-click always selects, double-click navigates. (#1911)

BugFixes:

• .ssa and .ass subtitle files get their styling removed during conversion (#1933)
• custom icons issue
• new database message for noauth (#1935)

Notes:

• Changed /api/media/subtitles api endpoint to better support subtitles.
• Correcting some errors in French language (#1947)
• add Dutch nl.json for frontend i18n -- thanks @Stephan-P (#1957)
• share banner and icon images automatically serve a scaled down 1024x1024

BugFixes:

• Can't access directories with space (and possibly other special characters) when browsing a public link share (#1956)
• External ASS subtitles are not usable in web preview (#1933)
• Filename blocking rename/move (#1950)
• enforcedOtp: true blocks all user settings updates with HTTP 400 (#1962)
• Share favicon URL not showing up and Share description causing endless loading (#1911)
• folder sizes not updated for changes to filesystem outside of filebrowser (#1974)

Notes:

• Removed upload api behavior to assume paths ending in "/" are folders, strictly uses isDir query param
• renamed public upload api query param from targetPath to path. see swagger docs.

BugFixes:

• fix stuck motion preview popup window issue
• Chunked uploads ignore User Scope and are saved to Source Root (#1894)
• share delete with user scope issue
• fix favicon pwa icon, having the PWA respect the favicon/loginIcon (#1899)
• delete prompt icons show image previews

Security:

• Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse)

New Features:

• "Divider" option in sidebar links to add a text or divider between links ()
• shares offer a "go to source Location" sidebar link and button when editing a share.

Notes:

• Share edit/delete permissions are scoped to the user's shares rather than global (#2050)

BugFixes:

• fixed the requirement that the database path needed to be set in the config file, now it loads FILEBROWSER_DATABASE value by default, fallback to config file property.
• Error downloading zipped directory: no such file or directory (users with scope) #2015

New Features:

• Resizable sidebar (#1896)
• OIDC Authentication: Change Button Text via frontend.oidcLoginButtonText (#1708)
• improved favicon processing (#1899)
  • supports more formats
  • supports larger images
  • automatcially generates multiple favicon sizes on startup for non-svg images. Custom svg favicons need a companion *.png to exist broad compatibilty
  • Enhanced media playback: Ability to control the queue from your device's lock screen and notification panel - Will also show metadata of the current playing media if available (#1917)

Notes:

• Better text file content detection (#1726)
• More url encoding changes for API which should make things more consistent. Open issues if you see path/source not found errors.
• adjustments to the startup behavior for sqlite index for reusing the previous database on startup
• CTRL + B disables sticky sidebar forever (#1869)
• added context menu back to duplicate finder
• Sharing a link for uploads - folder/file access and UX polishing (#1902)
• improved listing view and scrolling performance
• improved image viewer which will utilize recent thumbnails as a placeholder when loading the full image.
• Small reorganization of "Share" settings to make the popup clear (#1826)

BugFixes:

• Added docker default FILEBROWSER_CONFIG="/home/filebrowser/data/config.yaml" back -- mistakenly removed. see https://filebrowserquantum.com/en/docs/getting-started/config/#3-default-locations. (#1891)
• Fix brand text in login screen (#1898)
• Sidebar links cointains urls with 2x repeated source name (#1847)
• 2 factor auth getting overwritten if you edit the auth from admin (#1819)
• New created user's files are listing error, Probably related with language setting. (#1565)
• thumbnail generation cpu/memory and concurrency bug.
  • added 75MB filesize limit for image previews
  • optimized concurrency for large vs small images

BugFixes:

• startup icon generation order issue (#2019)
• login button on shares not showing (#2028)
• removed file watcher link in context menu for shares (#2025)
• Direct download link for single-file shares generates incorrect URL (#2026)
• Deleting files causes error V1.2.0 #2039

New Features:

• Global disable onlyoffice editor via "*" file option to disable all files for a specific user. (#1533)

Notes:

• upgraded imaging package and improved thumbnail generation performance. (#1797) (#1850)
• updated download api to use repeated file query param for path instead of files with comma. See swagger for details (#1881)

BugFixes:

• OnlyOffice stopped working after 1.2.0 upgrade due to download api changes
• Search result link to wrong path when search context other than / (#1863)
• File actions doesn't work if using user scopes (#1879)
• Drop items into folders doesn't work (#1860)
• duplicate finder context menu (#1862)
• File list in previews doesn't show the parent items (#1861)