PT-2026-29427 · Unknown · Filebrowser

Tomasvanagas · Published 2026-03-31 · Updated 2026-04-02 · CVE-2026-34530

Positive Technologies (AI Summary)

CVSS v3.1

6.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.62.2

Description: File Browser versions prior to 2.62.2 are susceptible to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. An administrator setting the branding.name field to a malicious payload injects persistent JavaScript that executes for all visitors, including unauthenticated users. The issue stems from the use of text/template instead of html/template in http/static.go, which lacks HTML escaping. The frontend template directly embeds these fields, allowing for the injection of arbitrary script into every page load. The ReCaptchaHost field can also be exploited to load arbitrary JavaScript from an admin-chosen origin. The absence of a Content-Security-Policy header exacerbates the risk.

Recommendations: Update to version 2.62.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34530

GHSA-XFQJ-3VMX-63WV

Affected Products

Filebrowser

References · 6

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-xfqj-3vmx-63wv · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34530 · Security Note
• https://osv.dev/vulnerability/GHSA-xfqj-3vmx-63wv · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.2 · Note
• https://twitter.com/CVEnew/status/2039647769376514177 · Twitter Post