PT-2026-29426 · Unknown+1 · Vue-Reader+2

Tomasvanagas · Published 2026-03-31 · Updated 2026-04-02 · CVE-2026-34529

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.62.2

Description File Browser's EPUB preview function is susceptible to Stored Cross-Site Scripting (XSS). A crafted EPUB file containing JavaScript can execute in a victim's browser when the file is previewed. The issue stems from the frontend/src/views/files/Preview.vue component passing allowScriptedContent: true to the vue-reader component, which, combined with allow-scripts and allow-same-origin in the iframe sandbox, renders the sandbox ineffective, allowing the script to access the parent frame's DOM and storage. The developers of epub.js explicitly warn against enabling scripted content. A proof-of-concept (PoC) demonstrates the ability to steal JWT tokens and exfiltrate a victim's public IP address. The vulnerability could lead to session hijacking and privilege escalation for users with upload access.

Recommendations Update File Browser to version 2.62.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34529

GHSA-5VPR-4FGW-F69H

Affected Products

Filebrowser

Epub.Js

Vue-Reader

References · 6

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-5vpr-4fgw-f69h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34529 · Security Note
• https://osv.dev/vulnerability/GHSA-5vpr-4fgw-f69h · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.2 · Note
• https://twitter.com/CVEnew/status/2039647773763715077 · Twitter Post