CVE-2026-62843
MEDIUM SEVERITYCVSS Score & Metrics
Base Score
6.8 / 10
Vector String
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Vulnerability Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-22
Source
NVD
Vendor
filebrowser
Product
filebrowser
External References
- https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0
- https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww
Discussion (0)
Add Comment
No comments yet. Be the first!