Caught blind, first pass
Eight matched outright and five flagged as the same underlying flaw.
Sample report
See the work, not just the promise.
Explore the complete Dokima report from a pinned release of File Browser, an open-source web file manager. Every finding is published with its technical evidence, validation notes and suggested remediation.
About this reportThe complete original report, published unredacted.
File Browser stopped accepting private security reports when its repository became read-only on 1 September 2026. The temporary responsible-disclosure redactions have therefore been removed. This is the untouched report snapshot, including every finding and the benchmark scorecard showing what Dokima did not find.
Run disclosure
A real codebase, pinned so the result can be checked.
- Target: File Browser v2.63.5
- Source commit:
a1e442ef9e4a - Generated: 29 July 2026 at 07:54 UTC
- Dokima build:
4232bbc - Runner and model: Claude with Opus
A fair test
Dokima went in blind.
Dokima reviewed the pinned source with no advisory, no hint and no expected answer to aim at. What you are reading is the report it produced on its own, findings and review notes included.
We then took every security advisory later published for this exact release and checked Dokima's report against each one by root cause, crediting nothing that was only a loose overlap. We hold a hard line: anything Dokima had not found by the snapshot linked here is scored against it in full, and every one is on the scorecard below.
The blind test result
Dokima caught every critical, and 14 of the 17 vulnerabilities disclosed in this build.
We pinned File Browser to v2.63.5, a release from before its security advisories were published, and ran Dokima against it with no knowledge of them. Its first blind pass caught 13 of the 17 issues later disclosed for this exact build. Its continuous re-review of the same source then caught the critical self-signup issue it had not found at first, bringing the total to 14 - including all three criticals - plus 43 further findings in the original report snapshot. The full technical detail for all findings is available in the report linked above.
SeverityCaughtAlso foundNot found
Critical3 of 3--
High6 of 7+3
CVE-2026-54096Medium4 of 5+14
CVE-2026-54093Low1 of 2+26
CVE-2026-62684Total14 of 17+433
Caught on re-review
The critical self-signup scope issue, caught as Dokima kept reviewing the same build.
Further findings in the snapshot
All are published with their technical detail, evidence and remediation.
Not yet found, shown below
One High, one Medium, one Low - left on the scorecard in full.
Disclosed vulnerabilityMatching Dokima findingResult
Critical
GHSA-6759-996p-gpj6Self-signup accounts inherit the server root as their scope.
Not found on the first pass, caught on continuous re-review of the same build
Found
Critical
CVE-2026-54088The auth hook drops login input into a shell command, allowing pre-auth remote code execution.
Found
Critical
CVE-2026-54089A forged proxy-auth header impersonates any user, including admins.
Found
High
CVE-2026-54092The public login API accepts unbounded input, exhausting CPU and memory.
Found
High
CVE-2026-55667A create-only user deletes files outside their scope through a followed symlink.
Found
High
CVE-2026-62685Username normalisation lets two distinct accounts share one home directory.
Found
High
GHSA-576v-w77m-gr84Case-folded signup usernames collide onto one home directory.
Found
High
CVE-2026-54091Public directory-share rules are checked in the wrong path namespace, exposing blocked files.
Found
High
CVE-2026-54097An over-broad path prefix lets one user delete other users' share links.
Found
High
CVE-2026-54096A public share made for a not-yet-existing path exposes whatever is later placed there.
Not flagged
Not found
Medium
CVE-2026-54094A scoped user reads and writes outside their scope through an in-scope symlink.
Found
Medium
GHSA-ffv3-7h97-993qtus uploads ignore the declared length, letting a user exhaust disk.
Found
Medium
CVE-2026-55668A scoped user writes outside their scope through a dangling symlink.
Found
Medium
CVE-2026-54093Backslash separators in archived filenames allow path traversal on download.
Not flagged
Not found
Medium
GHSA-7whw-q6gh-xr59The checksum endpoint skips the download permission check, leaking file hashes.
Found
Low
CVE-2026-62683A trailing-slash delete leaves a stale public share record behind.
Found
Low
CVE-2026-62684The share API returns a share's password hash and bypass token.
Not flagged
Not found
How we scored it. Found means a Dokima finding identified the same underlying flaw in the same code. In a few cases it drew a narrower conclusion than the advisory. Not found means the runs behind this snapshot did not surface it - scored against Dokima in full, with no middle ground. Dokima is built to keep running against the same code, and a later pass may pick up what an earlier one did not. The "also found" column counts 43 findings outside this original 17-advisory benchmark set, at Dokima's own severity rating. All are published in full in the report, including the findings that were temporarily redacted during the maintainer's reporting window.
Dokima re-reviews continuously as code changes, so a first pass is where it starts, not where it stops.
What you can inspect
The same report structure your team receives.
- Plain-English issue descriptions
- Technical evidence and affected scope
- Severity, confidence and verification status
- Attack path and practical outcome
- Detailed and plain-English remediation
- Finding status and review annotations
- Complete technical detail for every finding in the snapshot
Try it on your own source
Evaluate Dokima against a codebase your team already understands.
Start a full-product 21-day trial for your engineering team. No payment card required.