File Browser’s single–page application index page is vulnerable to a stored cross‑site scripting flaw that is triggered when an administrator sets the branding.name field to a malicious payload. The injected script is persisted and executed in every browser session that loads the index page, which means all visitors—including those who are not authenticated—can be targeted. The impact is the possible theft of credentials, session hijacking, or other malicious actions performed in the context of the affected user’s browser.

The vulnerability affects the File Browser file‑management interface from the vendor identified as File Browser, All brands using the open‑source product. Versions earlier than v2.62.2 are impacted, while v2.62.2 and later contain the fix.

The CVSS score is 6.9, indicating a medium severity, while the EPSS score is below 1% which suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that the attacker deliver a malicious payload via the branding.name field, which generally requires administrative access or compromise of an administrator’s account. Once the malicious script is stored, it will run for all users who view the index page.