Published: June 18, 2026
Last updated: June 19, 2026

v1.4.0-stable

This release is based on v1.4.4-beta!

Security:

  • [High] Path traversal in subtitle handler allows any authenticated user to read arbitrary files (GHSA-vvp7-h4fj-m28w).
  • [Moderate] Add Rate Limiting on Authentication Endpoint Enables Brute Force Attacks (GHSA-r4v7-6wcg-ghj5).

New Features:

  • Pinned files/folders (pr #2510) (pr #2396).
  • Markdown Image relative reference support (issue #2355).
  • Add an option to create a new folder for unarchiving (issue #2338).
  • Read-only source configuration via source.config.readOnly: true (issue #2438).
  • Add Passkey (WebAuthn) support for passwordless authentication (issue #2287) (pr #2379) – thanks @juansoler.
  • Lyrics support for audio files (pr #2360):
    • Updated UI for audio previews!
    • New panel for desktop, on mobile lyrics are inline (below the art).
    • Supports synced lyrics, the player gets syncronized in UI.
    • Supports embedded lyrics (ID3, USLT, flac, ogg, clyr) and sidecar .lrc files with the same name as the audio file.
    • The existent Q shortcut in audio files will toggle the new panel visibility.
    • Added E shortcut to change between tabs of the new panel if it’s open.
  • API log filtering support via apiFilter option for logging.
    • Regex filter that excludes matching full API paths from being logged. (eg. /user\?id\=self) Defaults to ^/health|^/favicon.ico|^/static|^/public/static.
    • Add config option to disable /health endpoint logging (issue #2291).
  • More shortcuts (pr #2300).
    • CTRL+F1 switch to normal view.
    • CTRL+F2 switch to gallery view.
    • CTRL+F3 switch to list view.
    • Double click on empty space to select all items.
  • Option to hide certain files in UI by extension (pr #2403) (issue #2277).
  • Additional search features:
    • Wildcard search similar to regex, but limited to sqlite GLOB syntax (issue #769).
    • Advanced search tool that shows all results in a listing thats sortable and actionable like a normal listing (issue #1051).
    • Advanced search supports multiple custom scopes per search.
    • Multiple search terms with AND or OR logic support.

Notes:

  • Added fallback to show text in notification if copy fails (pr #2517).
  • Added alt+arrow up shortcut as alias of backspace to go into parent directory (issue #2501) (pr #2521).
  • Added alt+arrow down shortcut as alias of enter to open files in Listing View (issue #2501) (pr #2521).
  • Updated help menu with better translations.
  • Migrate vue-i18n to v11 + lazy load languages (pr #2504) (issue #2472).
  • Migrate eslint to v10 + lint fix (pr #2488) (issue #2459).
  • Improved preview cancellation to improve performance when navigating UI.
  • Auth rate limiting can be disabled via auth.disableRateLimit.
  • Updated share hash middleware (pr #2443).
  • Updated source info popup to include private and readOnly properties.
  • Enhanced indexing scheduler which doesn’t wake the disk as often.
  • New API route media/lyrics used to fetch and parse lyrics (embedded or from .lrc sidecar) (pr #2360).
  • Swiping down gesture in fullscreen videos exit fullscreen instead of close preview (pr #2360).
  • Improved styles for path selection and tables.
  • Improved style of drag and drop into listing view (pr #2407).
  • Edit Sidebar links has new show tools in sidebar toggle and all users have this enabled by default. can be disabled via for new users userDefaults.sidebar.showTools: false.
  • Update user defaults ordering (issue #1140).
  • Save view modes and sizes into local storage instead of db (issue #2301) (pr #2300).

BugFixes:

  • Fix folder previews issue (pr #2487) (issue #2492).
  • Fix accidental exit on images while using gestures (pr #2508).
  • Socket field in config.yaml is ignored (issue #2497).
  • Fix keep opened file selected after closing its preview @anpryl (pr #2515).
  • Logout from share page now redirects to the share instead of /Login again (pr #2445).
  • This location cannot be reached error when navigating with FileTree in shares (pr #2445).
  • Fix FileTree rename and move actions in previews (pr #2445).
  • Delete prompt not showing date and thumbnails in some previews (pr #2445).
  • Fix path slash issue on windows (pr #2451) (issue #2433) (issue #2419).
  • Always force url rewrite for onlyoffice internal URL. Fixes Error saving with OnlyOffice (issue #2450).
  • Overriding a Deny with an Allow not working (issue #2405).
  • Blue overlay when using gestures in video files on mobile (pr #2360).
  • Playback queue wasn’t updating when changing of folder (pr #2360).
  • Navigate close settings shows “something went wrong” (issue #2047).

Full Changelog: v1.3.3-stable…v1.4.0-betaRelease:: v1.4.0-stable.

v1.3.3-stable

Security:

Notes:

Full Changelog: v1.3.2-stable…v1.3.3-stableRelease: v1.3.3-stable.


v1.3.2-stable

Security:

Full Changelog: v1.3.1-stable…v1.3.2-stableRelease: v1.3.2-stable.


v1.3.1-stable

Security:

Notes:

  • Creating/deleting password-based user requires reauthentication (issue #2112).

BugFixes:

  • Fix context menu items and adjust when items show to more accurately reflect permissions.
  • Quick download icon style after icon change.
  • Missing error popup for resource creation actions (upload/create).
  • EnforcedOtp login failure until restart (issue #2330).
  • Thumbnails for Folders only display sporadically (issue #2353).
  • Unwanted user scope change for users with non-default scopes (issue #2347).
  • Fix sidebar source info totals (issue #2321) (issue #2322) (issue #982)
  • Error uploading a large number of photos – only 100 items get uploaded (issue #2348).
  • TOTP works for admin but fails for standard users on re-login until Docker is restarted (issue #2330).
  • No Loginfields shown if password authentication is set to false (issue #2331).

Full Changelog: v1.3.0-stable…v1.3.1-stableRelease: v1.3.1-stable.


v1.3.0-stable

New Features:

  • New Sidebar Features:
    • Sidebar tree navigation (pr #2006) (issue #350).
    • Source usage to be customized to show os-reported values rather than calculated. This can be changed per source by editing the source link in the sidebar (issue #1266) (issue #982).
  • Archive/Unarchive actions in UI (issue #1252) (issue #335) (issue #1569):
    • New api to archive/unarchive files on the server.
    • Requires create user permissions.
    • Archiving actions respect server.maxArchiveSize.
  • Added share icon to items that are shared (issue #1420).
  • Authentication enhancements:
    • LDAP login support with OIDC feature parity (issue #591).
    • userGroup for OIDC and LDAP, only users in a group will get access (issue #1964).
    • Add JWT token authentication support (issue #1364).
  • Enhanced thumbnail and item previews.
    • Added ability to show motion preview for folders with multiple child items that have previews. cycles through the first 4 images.
    • Support for reading embedded images from raw image or heic/heif files (issue #215).
    • Reorganized and simplified thumbnail settings in profile settings (issue #1968).
    • Removed highQuality thumbnail option, which only affected gallery view. Now it’s always enabled.
    • Improved caching for unsupported images, the same file won’t be attempted again with the same modtime.
    • Supports 3D model previews.
  • FileWatcher also supports watching directories.
  • Support previews for 3D model files (issue #1273):
    • Supported formats via threejs: GLTF, GLB, OBJ, STL, PLY, DAE (Collada), 3MF, 3DS, USDZ, USD, USDA, USDC, AMF, VRML, WRL, VTK, VTP, PCD, XYZ, VOX, KMZ, FBX.
    • Supports animations (for formats that contain them).
    • Supports embedded textures, external neighboring file textures, or textures in /textures subdirectory.
  • Enhanced prompts:
    • All prompts have a taskbar with a close button.
    • Prompts can be freely moved by dragging the taskbar.
    • Prompt styling has been updated.
    • Clicking outside of prompts no longer automatically closes them.
  • WebDAV support (issue #209) – thanks to @reddec for (pr #1764).
    • See webdav docs on how to use.
    • Requires api an un-customized api token as a password.
    • Respects access rules.
    • Requires download permission to view and modify/create/delete permission to modify.
  • More user options for settings (pr #2072) (pr #2067):
    • Option to disable thumbnails userDefaults.preview.audio and userDefaults.preview.models for Audio and 3D Models.
    • Option to disable files in the Tree navigation userDefaults.hideFilesInTree.
    • Option to disable source files deletion when creating/extracting archives. userDefaults.deleteAfterArchive.
  • Option in settings userDefaults.preferEditorForMarkdown to prefer editor first for Markdown files (pr #2160) (issue #2136).
  • Copy to clipboard button for code blocks in Markdown Viewer (pr #2160).
  • Add “Last modified” filter in search dialog (issue #2157).
  • Copy/paste files and folders (CTRL+C/CTRL+V) from other apps (win explorer, thunar, finder, etc) to upload them directly (pr #2197).
  • Caption font size can be adjusted in video settings.
  • Ability to adjust the startup check method for SQL database via server.startupIntegrityCheck (issue #2221).
  • Status bar for editor and markdown viewer (pr #2226).
  • Epub placement URL anchors to bookmark a specific location on the doc.
  • Add Requirement for Current Password When Changing Account Password or user for permissions and scope (issue #2112).
  • Copy file path to clipboard through right-click (issue #2204).

Notes:

  • User scope editing has path picker and filesystem validation.
  • Removed upx compression on docker image (issue #2193).
  • Videos double-tap to fast-forward and rewind added.
  • Adjust Image album swipe behavior (issue #2068).
    • Swipe animation for next/previous
    • Swipe down on the image to close and go to the parent folder.
    • Supports videos
  • Chunked uploads will save to a temporary file at the destination and be renamed on completion. Better upload pause handling (issue #2129).
  • The Icons in the UI were updated! (pr #2203).
    • More supported icons in the Icon Picker tool.
    • More file types have new icons across all the listings (such as .md, .apk, etc).
  • Removed upx compression on docker image (issue #2193)
  • Chunked uploads will save to a temporary file at the destination and be renamed on completion. Better upload pause handling (issue #2129).
  • Deprecated source.config.CreateUserDir, now it’s always true. If a user directory doesn’t exist it will get created empty.
  • CTRL+Mouse Wheel shortcut to change listing size. Also for changing font size in editor (pr #2250) (issue #2227).
  • Docs preview for text and PDF has a 2-second timeout. If it hangs for whatever reason, the maximum time would be 2 seconds (issue #2105) (pr #2114).
  • Downloading multiple file streams the archive creation rather than using cacheDir – thanks @janakoram (pr #2125) (issue #2130).
    • server.maxArchiveSizeGB now defaults to 20 (GB) and only applies to archive/unarchive actions (not downloads).
    • The browser download progress bar will no longer show for archive downloads. This is the main drawback to the streaming approach.
    • Should allow for much higher parallel download support and lower cleanup maintenance.
  • Remote IP in logs now prefers X-Forwarded-For if it exists, then X-Real-IP, then lastly the standard RemoteAddr. Useful when running behind a proxy to log the public IP of each request. (issue #2110).
  • Changed loading spinner style to be more compatible with Safari browsers.
  • Share icon does not show in the share listing or for shares for other users.
  • File Size Analyzer tool max items increased from 100 to 200.
  • Changed symlink detection logic.
  • Docker images default to filebrowser user instead of root.
  • Reorganized api routes:
    • Consolidated tags for swagger to be more accurately grouped.
    • Tools are all behind /api/tools routes.
    • /api/raw is deprecated (but functional). The /api/resources/download route will be used instead.
    • /api/preview has been removed and replaced with /api/resources/preview.
    • /api/onlyoffice has been replaced with /api/office.
    • /api/shares has been moved to /api/share/list.
    • /api/auth/tokens has been moved to /api/auth/token/list and /api/auth/token has been added to get specific token info.
    • PUT /api/token has been moved to POST /api/token.
    • /public/api/shareinfo has been moved to /public/api/share/info.
    • POST /resources/bulk/delete api has been moved to DELETE /resources/bulk (issue #1984).

BugFixes:

  • Long folder names get cut off at the top navigation bar (issue #1934)

Full Changelog: v1.2.4-stable…v1.3.0-stableRelease: v1.3.0-stable.


v1.2.4-stable

Security:

  • Anonymous user shouldn’t see server folder path with the Go to source location button from the share page (issue #2216).

Notes:

BugFixes:

  • Share banner URL not rendering in Open Graph (og:image) meta tags for link previews (issue #2189).

Full Changelog: v1.2.3-stable…v1.2.4-stableRelease: v1.2.4-stable.


v1.2.3-stable

Security:

Notes:

  • Docs preview for text and pdf has a 2 second timeout. If it hangs for whatever reason, the maximum time would be 2 seconds (issue #2105) (issue #2114).
  • [docker] ffmpeg version upgraded to 8.1

BugFixes:

Full Changelog: v1.2.2-stable…v1.2.3-stableRelease: v1.2.3-stable.


v1.2.2-stable

Security:

  • Patched Stored XSS in public share page via unsanitized share metadata (text/template misuse) (GHSA-r633-fcgp-m532).
  • Patched Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info (GHSA-525j-95gf-766f).

New Features:

  • “Divider” option in sidebar links to add a text or divider between links (issue #1875).
  • Shares offer a “go to source Location” sidebar link and button when editing a share.

Notes:

  • Share edit/delete permissions are scoped to the user’s shares rather than global (issue #2050).
  • OIDC group claims accepted as map (pr #1444).

BugFixes:

  • Fixed the requirement that the database path needed to be set in the config file, now it loads FILEBROWSER_DATABASE value by default, fallback to config file property.
  • Error downloading zipped directory: no such file or directory on users with scope (issue #2015).

Full Changelog: v1.2.1-stable…v1.2.2-stableRelease: v1.2.2-stable.


v1.2.1-stable

Read: New Announcement

BugFixes:

  • Startup icon generation order (issue #2019).
  • Login button on shares not showing (issue #2028).
  • Removed file watcher link in context menu for shares (issue #2025).
  • Direct download link for single-file shares generates incorrect URL (issue #2026).
  • Deleting files causes error (issue #2039)

Full Changelog: v1.2.0-stable…v1.2.1-stableRelease: v1.2.1-stable.


v1.2.0-stable

Read: New Announcement

This is a major version update with many changes which could cause unexpected behavior. Upgrades should proceed with caution and report any undesirable behavior. See the changes over v1.1.3-stable below:

New Features:

  • SQLite-based indexing.
    • reduced memory usage, higher CPU and IO usage.
    • index persistence between restarts requires persistent cacheDir.
  • New tool: Realtime File Watcher – Low latency if user has realtime permissions (issue #917).
  • Breadcrumbs act as a drop area (pr #1785)
  • Access control works with individual files too.
  • Conditionally hide symbolic links as indexing rule config (issue #1540)
  • Search multiple sources at once (issue #848)
  • File uploads resume from bad internet connection (issue #1599)
  • Chunked downloads - optionally enabled in settings or userDefaults – fix for 524 errors on cloudflare (issue #1502).
  • Made size calculation consistent: defaults to “size on disk” style to mimic du -sh, and allows config source.config.useLogicalSize: true for 0 size folders and actual size file sizes. (issue #1266).
  • Allow deleting selected duplicates from duplicate finder (issue #1659).
  • Share changes:
    • Opengraph support for shared links.
    • Allow adding “share settings” option to customizable sidebar links (issue #1825).
    • File picker for share favicon and banner icon.
    • Allow disabling “Login button” for shares (issue #1673)
  • Global disable onlyoffice editor via * file option to disable all files for a specific user (issue #1533).
  • Resizable sidebar (pr #1896)
  • OIDC Authentication: Change Button Text via frontend.oidcLoginButtonText (issue #1708).
  • Improved favicon processing (issue #1899)
    • Supports more formats.
    • Supports larger images.
    • Automatcially generates multiple favicon sizes on startup for non-svg images. Custom svg favicons need a companion *.png to exist broad compatibilty.
  • Enhanced media playback: Ability to control the queue from your device’s lock screen and notification panel - Will also show metadata of the current playing media if available (pr #1917).

Notes:

  • server.cacheDirCleanup defaults to false instead of true. For docker, you would still need to mount a cacheDir volume to persist cache between restarts.
  • Indexing rules have been streamlined, see docs. The previous style is deprecated but still functional.
  • Improved listing load times for directories with metadata – a two-pass approach. First a fast load to get the listing items, then a second api request to include metadata.
  • Enhanced delete prompt.
  • bulkDelete API added and replaces the delete API for all UI actions. See swagger docs for usage.
  • raw download and patch resource API simplified to a single source per request. See swagger docs for usage.
  • UserScope function re-organization, if you notice any user scope issues, please open a GitHub issue.
  • File upload resume from bad internet connection (issue #1599)
  • Upgraded imaging package and improved thumbnail generation performance (issue #1797) (issue #1850).
  • Updated download API to use repeated file query param for path instead of files with comma. See swagger for details (issue #1881)
  • Better text file content detection (issue #1726)
  • More url encoding changes for API which should make things more consistent. Open issues if you see path/source not found errors.
  • Adjustments to the startup behavior for sqlite index for reusing the previous database on startup.
  • CTRL + B disables sticky sidebar forever (issue #1869)
  • Sharing a link for uploads - folder/file access and UX polishing (issue #1902).
  • Improved listing view and scrolling performance.
  • Improved image viewer which will utilize recent thumbnails as a placeholder when loading the full image.
  • Small reorganization of “Share” settings to make the popup clear (issue #1826).
  • Removed upload api behavior to assume paths ending in / are folders, strictly uses isDir query param.
  • Renamed public upload api query param from targetPath to path. see swagger docs.
  • Changed /api/media/subtitles api endpoint to better support subtitles.
  • Correcting some errors in French language (issue #1947)
  • Add Dutch nl.json for frontend i18n – thanks @Stephan-P (issue #1957).
  • Share banner and icon images automatically serve a scaled down 1024x1024.

Full Changelog: v1.1.3-stable…v1.2.0-stableRelease: v1.2.0-stable.


v1.1.3-stable

Resolves CVE found by @ByteAfterlife affecting password protected share links.

Security:

Full Changelog: v1.1.2-stable…v1.1.3-stableRelease: v1.1.3-stable.


v1.1.2-stable

BugFixes:

  • Fix transversal vulnerability.
  • Fix image generation concurrency limits.

Full Changelog: v1.1.1-stable…v1.1.2-stableRelease: v1.1.2-stable.


v1.1.1-stable

Notes:

  • Major git container tag request (issue #1756)
  • showHidden is now a backend attribute. Shares will NOT show hidden files by default unless configured to.
  • Improved listing view UI performance, especially for folders with many items. (issue #1773)

BugFixes:

  • Sharing broken if source disableIndexing: true (issue #1742)
  • Password protected share permission (issue #1729) (issue #1606) (issue #1593)
  • Sidebar Sliding left (issue #1737)
  • File permissions not working (pr #1444)
  • Handle Close() errors in archive creation (pr #1745)
  • Move custom CSS and user-selected theme styles to the end of the body (pr #1744).
  • SortBy config is not respected when navigating next/previous (pr #1787) (issue #1786).
  • unauthenticated users unable to preview files (issue #1792)
  • File permission not correctly applied (issue #1790)
  • API Key loses download permission after creation despite being enabled (issue #1799).
  • Never exclude root folder (issue #1749).
  • Sources with “files” name not showing after 1.1.x update (issue #1772).
  • Symbolic links can’t be deleted from webui (issue #1566)
  • Panic: close of closed channel during indexing (issue #1771)
  • Public sharing returns 404 errors for album art (issue #1792)
  • Directories with some symbols in their name “fail to open” (issue #1808).

Full Changelog: v1.1.0-stable…v1.1.1-stableRelease: v1.1.1-stable.


v1.1.0-stable

This update brings all changes present in v1.1.4-beta to stable.

New Features:

  • Toggle to show searching results with thumbnails (issue #1545)
  • Added tools:
    • File size analyser – quickly show the largest files in an interactive graphical chart
    • Duplicate finder – find probable duplicate files larger than 1MB
    • Material icon picker and previewer
  • Listing View Style updates
    • Status bar for listing view (pr #1459)
    • Duration field shows up if media is shown with duration
    • More dynamic view modes with additional styling changes
    • Total display modes consolidated into 3 main groups: list, gallery and normal. icon and compact modes exist as views based on display size setting.
  • Customizable sidebar links:
    • Logged-in users can have their preferences saved and synced
    • Can rearrange, add custom links, and save your preferences.
    • Can customise shares with their own custom sidebar links.
  • Dynamic scopes for OIDC (issue #1414) (issue #1363)
  • Share and Access Rules validation:
    • If a file/path is moved/renamed in UI, its rules and shares will always follow.
    • If a file/path is moved/renamed outside UI, a warning message will show andthe ability to associate with the new path
  • Cascade delete access in Access Management when deleting a User (issue #1347)
  • Enhanced notifications (issue #1331)
    • Added “toast” notification type support – most success messages show as toast now.
    • Multiple stacked notifications possible
    • Notification button support, such as clicking to open a folder after moving a file.
    • Notification history (not including toasts)
    • Add swipe and visual timeout to notifications (pr #1600)
  • Choose different bind IP via server.listen (issue #1573)
  • Allow disabling clearing cache each startup via server.cacheDirCleanup: false in config (issue #1576)

Notes:

  • File list has loading spinner to help prevent double click issues and give better feedback.
  • Improved cacheDir startup checks.
    • Warning for slow read/write speeds below 50MB/s
    • Warning for low free space below 20GB
    • Warning if read/write latency is slow
    • Fatal for any errors reading or writing to the directory
    • Links to official docs for more info
  • Access rules changes:
    • Denied folders won’t show up in parent directory listing view (issue #1684)
    • Tools will respect access rules.
    • Shares will check access rules based on user that created the share.
  • Continue create user dir scope even if filesystem path creation fails (issue #1509).
  • Access control cache is cleared more aggresively to ensure no delay.
  • Removed default .ico favicon in favor of .svg

BugFixes:

  • Passwords with special characters not working properly (issue #1648).
  • Fix/Improve some behaviors in nextPrevious (pr #1707)
  • Files recognized as folder if they have the same name as previously deleted folders (issue #1697).
  • Multi logger support issue (issue #1701)

Full Changelog: v1.0.3-stable…v1.1.0-stableRelease: v1.1.0-stable.


v1.0.3-stable

BugFixes:

Full Changelog: v1.0.2-stable…v1.0.3-stableRelease: v1.0.3-stable.


v1.0.2-stable

Notes:

  • [docker] Upgraded ffmpeg 8.0 to 8.0.1

BugFixes:

  • Added missing exiftool to docker image for heic conversion orientation support.
  • Uploading a file will silently overwrite any existing file with the same name (issue #1564).
  • Unable to download folder as ZIP (issue #1604)
  • Issues downloading and file actions on password protected share.

Full Changelog: v1.0.1-stable…v1.0.2-stableRelease: v1.0.2-stable.


v1.0.1-stable

BugFixes:

  • UserDefault always applies to newly created users (issue #1518)
  • Updating user’s own password sometimes doesn’t work.
  • Anonymous Share link with optional password does not allow downloads (issue #1553).
  • Share options should go in the meta tags (issue #1511)
  • Unable to select compression format when downloading multiple files/dir via Share link (v1.0.0) (issue #1557).
  • Fixed sidebar clipping on some browsers like safari.
  • Files show as Download is not available even though it is (issue #1537).

Full Changelog: v1.0.0-stable…v1.0.1-stableRelease: v1.0.1-stable.


v1.0.0-stable

New Features:

  • Login icon support added via frontend.loginIcon config path variable.

Notes:

  • Updated default login icon.
  • Stopped publishing rolling dev docker tag.
  • Build requirement change – from node 18 > node 20 with npm 9.0.0+
  • Version is not shown for unauthenticated users (issue #1444)
  • Adjusted how static assets are served to better handle icon standards.
  • Fixed signup login (issue #1444)
  • Update makefile linker flags to properly set version and sha (pr #1474).
  • Better windows build support – make setup and make dev work as long as git is installed on windows.
  • Added better first initilization detection.
    • If filebrowser initialized and does not detect a database, a new warning message in server logs appears.
    • If theres no database on start, any admin user’s first login will see a welcome message in the ui.
    • For docker, it defaults to ./data/database.db, but will also fallback to ./database.db without any additional configuration.

BugFixes:

  • Generating multiple HEIC previews in parallel fails (issue #1470).
  • ? in path not always encoded right (issue #1447)
  • Fixed some condition that the halloween background doesn’t load properly.
  • Some comments not showing up on config viewer in settings.

Release: v1.0.0-stable.