PT-2026-60214 · Unknown · Filebrowser

CVE-2026-62843 · Published 2026-07-15 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions File Browser versions 2.63.6 through 2.63.16

Description The archive builder improperly handles filenames by using strings.ReplaceAll(nameInArchive, "", "/"). This allows a user with upload permissions to create a file with backslashes in the name, such as ....evil.sh, which is converted into a POSIX path ../../evil.sh. Consequently, when another user downloads and extracts the resulting zip or tar archive, the file can escape the intended extraction directory.

Recommendations Update to version 2.63.17.

Exploit

Fix

Path traversal

Relative Path Traversal

Weakness Enumeration

CWE-22

CWE-23

Related Identifiers

CVE-2026-62843

GHSA-83XP-526H-J3WW

GO-2026-6026

OPENSUSE-SU-2026:21483-1

Affected Products

Filebrowser

References · 1744

• 🔥 https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/62xxx/CVE-2026-62843.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-62843 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-83xp-526h-j3ww · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-62843 · Security Note
• https://osv.dev/vulnerability/GO-2026-6026 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0 · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17 · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note