Skip to content

filebrowser

File Storage & Sync

Web File Browser

Go Latest v2.0.0-preview-3 · 2d ago Security brief →

Features

  • Self-hosted web-based file manager with modern responsive UI
  • Advanced user management (OIDC, LDAP, JWT, password + 2FA, proxy)
  • Real-time search, folder size display, and customizable sharing options

Recent releases

View all 27 releases →
v2.0.0-preview-3 Breaking risk
⚠ Upgrade required
  • Run the database migration script before upgrading (see migration guide)
  • Use the config‑migration tool to convert legacy configuration files; refer to About v2.0.0 for details
  • Update any scripts or integrations that reference removed API routes (/api/raw, /share/…) and renamed environment variable FILEBROWSER_DATABASE_PATH
Breaking changes
  • Removed GET /api/raw and /public/api/raw download routes — use /api/resources/download
  • Removed /share/… redirect to /public/share/… — use /public/share/… directly
  • Removed singular `source` search API param, bare `scope` paths without sourceName:, and `glob`/`useGlob` aliases — use sources and useWildcard respectively
Notable features
  • Granular per‑source file permissions (view, download, modify, create, delete) with automatic migration from global settings
  • View grant mechanism to separate UI viewing from downloading
  • ffmpeg hardware acceleration detection and support via go‑ffmpeg
Full changelog

What's Changed

[!CAUTION]
This is a pre-beta preview of v2.0.0 and should be treated as a test build. Make sure you keep your existing configuration and files safe.

This version represents the most significant change to date. It requires both a database migration and config structural changes. See the migration guide for step-by-step upgrade instructions, About v2.0.0 for a full summary, and the config migration tool to convert legacy config.

ATTENTION: Consider enabling Send deployment analytics in settings > system & admin to help populate some of the deployment info data. Join the discussion on this release for support or issues you notice.

Breaking Changes:

  • Removed: GET /api/raw and GET /public/api/raw download routes — use /api/resources/download instead.
  • Removed: /share/… URL redirect to /public/share/… — use /public/share/… directly.
  • Removed: singular source search api param (use sources), bare scope paths without sourceName: prefix, and glob / useGlob aliases (use useWildcard).
  • Removed config.conditionals, source-level indexingIntervalMinutes (indexing always uses adaptive scheduling), and deprecated rule fields fileNames / folderNames / top-level hidden — use config.rules with fileName, folderName, and ignoreHidden on rules.
  • Removed: deprecated userDefaults config formats (nested and flat) — use the config migration tool to convert before upgrading.
  • Changed: PUT /api/users moved to the more appropriate PATCH method.
  • Changed: http related config options in server config key moved to http config key. See HTTP settings.
  • Changed: FILEBROWSER_DATABASE environment variable — use FILEBROWSER_DATABASE_PATH instead. See Environment variables and Server settings.
  • Changed: Moved stream api to /api/media/stream. See API reference.
  • Changed: CLI user management — canonical commands are user set <username> --password [value] and user promote <username>; set -u username,password is deprecated. See CLI reference.

New Features:

  • View grant mechanism to distinguish between UI viewing and download. See Access control overview.
  • ffmpeg hardware acceleration detection and support via go-ffmpeg
  • granular per-source file permissions (view, download, modify, create, delete) with automatic migration from global permissions
    • per-source defaults configurable in settings > access management
    • view permission is automatically set to true unless explicitly set to false. See Access control overview.
  • New activity logs for user activity.
  • Media player improvements:
    • Refreshed playback queue UI: Supports thumbnails, stored into session storage, and has a "clear queue" button (#2575) (#2600).
    • Loop now has 3 states (off/single/all) and neither of them will clear the existing queue (#2600).
    • New "Audio visualizer" for audio files (desktop-only), you can configure some basic things to your taste (#2575) (#2620).
    • The current state of the audio panel now is stored into local storage.
    • More gestures: Swipe up to enter/exit fullscreen, long-press to change playback speed, single tap to pause (#2575).
    • Videos now will resume fullscreen and PiP when navigating (queue auto-navigation, swipes gestures or next/previous) (#2649).
  • Added F4 shortcut to refresh the current directory and metadata (#2600).
  • opt-in feature to send deployment analytics to filebrowser quantum developer servers
    • anonymized with a viewer so users can see what info would be sent.
    • if opt-in, every month a snapshot of your deployment config would be sent to developer servers
    • this will help me know what features are being used and what versions everyone is on over time. I will also provide a public dashboard with this information in the future.
  • WebDAV now supports set modification time via the X-OC-Mtime header for clients that support it (#2626). See WebDAV docs.
  • Copy operations now preserve their original modification times (#2642) (#2647):
    • WebUI preserves both, files and directories.
    • WebDAV COPY preserves modification times only for files, is limitation we have with webdav.
  • User default enhancements
    • Config userDefaults seeds SQLite on first run; only fields explicitly set in config stay locked in Settings → User defaults (other defaults remain editable)
    • Added administrator controls for universal user defaults and enforced preferences in settings > user management > user defaults.
    • Added configurable default file permissions per source in settings > access management.
    • Added a User Defaults editor for account, permission, and profile preferences in the edit/create user prompt. See User management.
  • Database env var rename: FILEBROWSER_DATABASE is removed (startup fails if set). Use FILEBROWSER_DATABASE_PATH (default filebrowser.sqlite) or server.database.path in config. See Environment variables and Server settings.
  • CLI: user set with --password (inline value, interactive prompt on TTY, or piped stdin); user promote for admin grant without password reset. See CLI reference.

Notes:

  • v2.x.x uses a new write-through backend state management. Changes go through a fast memory layer and also write changes to database to stay in sync. See About v2.0.0.
  • CLI server start (./filebrowser), setup, version, and set rule syntax unchanged; see CLI docs
  • new dropdown and input styles
  • user updates are more granular, don't include entire user payload.
  • user.id has been moved to a backend property and all frontend apis now query users by username. Swagger has been updated. See API reference.
  • removed legacy and deprecated properties from API responses and generated config output
  • /api/media/stream is audio/video only (range-based chunking). Non-media inline viewing uses GET /api/resources/view. Both endpoints use the same viewToken from file metadata. See API reference.
  • removed exiftool as an optional helper, always built with the supported libraries.
  • If migration issues arise, see Migration troubleshooting.
No immediate action
v1.5.2-beta Bug fix

OnlyOffice sync + TOTP reset

No immediate action
v1.5.1-beta Bug fix

Upload shares password bugfix

No immediate action
v1.5.0-beta New feature

Lazy search + case sensitivity

Review required
v1.4.4-beta Bug fix
Auth RBAC

Pin resets permissions

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
7,454
Forks
390
Languages
Go Vue JavaScript

Install & Platforms

Platforms
linux macos windows

Alternative to

Filebrowser Filestash Nextcloud Google Drive FileRun

Beta — feedback welcome: [email protected]