CVE-2026-54093
published 2026-06-25CVE-2026-54093: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6…
PriorityP433medium6.8CVSS 4.0
AVLACLATNPRNUIPVCNVIHVANSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.19%
8.7th percentile
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for backslashes (\ is only a path separator on Windows). A file whose name contains Windows-style traversal is accepted by the resource handlers, stored on the Linux filesystem with a literal backslash name, and then emitted verbatim as the archive entry name. Windows extractors interpret \ as a path separator and write the extracted file outside the extraction directory — arbitrary file write on the victim who downloads and extracts the archive. This vulnerability is fixed in 2.63.6.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| filebrowser | filebrowser | < 2.63.6 | 2.63.6 |
| github.com | filebrowser_filebrowser | 0 – 1.11.0 | — |
| github.com | filebrowser_filebrowser_v2 | >= 0 < 2.63.6 | 2.63.6 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
filebrowser File Browser up to 2.63.5 on Linux path traversal (GHSA-gxjx-7m74-hcq8)
vuldb·2026-06-26·CVSS 6.8
CVE-2026-54093 [MEDIUM] filebrowser File Browser up to 2.63.5 on Linux path traversal (GHSA-gxjx-7m74-hcq8)
A vulnerability was found in filebrowser File Browser up to 2.63.5 on Linux. It has been declared as critical. This affects an unknown part. Executing a manipulation can lead to path traversal.
This vulnerability is tracked as CVE-2026-54093. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
GHSA
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames
ghsa·2026-06-12
CVE-2026-54093 [MEDIUM] CWE-22 File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames
File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames
### Summary
filebrowser builds the download-as-zip / download-as-tar archive entry names with `filepath.ToSlash`, which on a Linux host is a no-op for backslashes (`\` is only a path separator on Windows). A file whose name contains Windows-style traversal (`..\..\..\evil.txt`) is accepted by the resource handlers, stored on the Linux filesystem with a literal backslash name, and then emitted **verbatim** as the archive entry name. Windows extractors (Explorer, 7-Zip, WinRAR, .NET `ZipFile.ExtractToDirectory`) interpret `\` as a path separator and write the extracted file **outside** the extraction directory — arbitrary file write on the victim who downloads and extracts the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-25
Published