CVE-2026-54093 Details
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for backslashes (\ is only a path separator on Windows). A file whose name contains Windows-style traversal is accepted by the resource handlers, stored on the Linux filesystem with a literal backslash name, and then emitted verbatim as the archive entry name. Windows extractors interpret \ as a path separator and write the extracted file outside the extraction directory — arbitrary file write on the victim who downloads and extracts the archive. This vulnerability is fixed in 2.63.6.
A path traversal vulnerability has been identified in File Browser versions through 2.63.5. The issue arises in the download-as-zip and download-as-tar functionalities, where the application improperly handles Windows-style backslashes in file names. On Linux systems, backslashes are treated as literal characters rather than path separators, allowing files with traversal payloads to be stored with backslashes in their names. When these files are downloaded and extracted on Windows, the backslashes are interpreted as path separators, leading to arbitrary file writes outside the intended extraction directory. This vulnerability can be exploited by any authenticated user with Create permissions, and affects users who download and extract archives on Windows.
Users can update to File Browser version 2.63.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 25, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| File Browser | <= 2.63.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | New CVE Received | [email protected] |
| Jun 25, 2026 | CVE Modified | CISA-ADP |