File Browser's Creator Archives the Self-Hosted Project for Good, Citing Unfixable Security Flaws
Henrique Dias is retiring File Browser, archiving its GitHub repo on September 1 after concluding the decade-old codebase can't be patched into shape.
Overview
Henrique Dias, the creator and sole maintainer of File Browser, one of the best-known self-hosted file managers in the open-source community, has announced he is ending active development of the project for good. In a blog post published July 28, Dias said the project’s GitHub repository will be archived on September 1, 2026, after which there will be no further releases, bug fixes, or security patches.
What We Know
File Browser gives users a web-based graphical interface for managing files on a server — browsing folders, uploading and downloading files, creating directories, and editing text — without requiring SSH access or the command line. Over the years it became one of the most recognizable tools in the self-hosting space, drawing more than 35,000 GitHub stars and around 4,000 forks; GitHub’s repository page currently lists the project at 35.7k stars and 4.0k forks.
This is not the project’s first wind-down. Dias wrote that in 2020 he published a first “Goodbye File Browser” post and “handed the project over to someone in the community,” before resuming control after it went unmaintained. This time, he says the decision is final. In the July 28 post, Dias explained that the codebase’s problems run too deep to fix incrementally: “What I’ve come to accept is that this can’t be patched into shape. File Browser would need to be rewritten from the ground up, with security and a good API in mind, neither of which was on my mind when I was 15,” he wrote, referring to his age when he started the project more than a decade ago.
Dias pointed to specific, unresolved session-management flaws as an example of the deeper design problems: “expired tokens keep working in some situations, and logging out doesn’t invalidate a token, so if someone stole it, it still works,” he wrote. The project’s GitHub repository carries its own warning that two classes of vulnerability — command execution and session/JWT handling issues — remain unaddressed and will not be fixed, and it recommends running File Browser behind a reverse proxy with TLS, disabling command execution, and containerizing it as an unprivileged user.
Beyond the technical debt, Dias cited a loss of motivation: “Mostly, though, the will isn’t there anymore. For me this is a project from over ten years ago. It reached its goal, it happened to become popular, and maintaining a codebase I don’t think is good doesn’t give me any pleasure,” he wrote.
File Browser version 2.63.22, released July 27, 2026, was originally planned as the final release; it shipped fixes for the PWA manifest’s icon sources, rules around recursive operations and expired proxy tokens, a scrollable sidebar, stalled uploads, and updated dependencies including postcss and dompurify. A follow-up, version 2.63.23, arrived the same day as one last housekeeping release, replacing links to the project’s website with direct links to the GitHub repository so documentation stays reachable after the shutdown — making it the project’s actual final release. Both release notes carry the identical wind-down notice: “File Browser is winding down and this is the last planned release. The repository is archived on 2026-09-01. After that date there will be no further releases, bug fixes, or security fixes. Existing releases and Docker images stay online and will not be withdrawn.”
Because File Browser is distributed under the Apache License 2.0, the official project’s closure does not prevent others from forking the code and continuing development independently.
What We Don’t Know
Dias’s post does not specify whether he plans to endorse or contribute to any successor project, and no official replacement has been named. It is also not yet clear how existing Docker-based deployments will be affected over the longer term once the unaddressed command-execution and session-handling issues become public knowledge without any prospect of an official fix.
Analysis
File Browser’s closure is a familiar story in open-source maintenance: a project built by a teenage hobbyist grew far beyond its original scope and userbase, while the time and expertise needed to keep its security model current did not grow with it. Dias’s own account — instructing users that the software’s remaining vulnerabilities won’t be patched and should be mitigated instead through network-level hardening — underscores a recurring tension in self-hosted infrastructure between popularity and sustainable stewardship.