Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.
Published: 2026-07-15
Score: 6.8 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The archive builder in File Browser contains a logic flaw that replaces backslashes with forward slashes before adding entries to a ZIP or TAR archive. A user with upload rights can name a file using backslashes (for example '..\\..\\evil.sh'), which is transformed into '../../evil.sh' in the archive. When another user downloads and extracts the archive, the path traversal allows the bad file to be written outside the intended extraction directory, potentially overwriting existing files or placing executable payloads in privileged locations.

Affected Systems

File Browser versions 2.63.6 through 2.63.16 are affected. The fix is in version 2.63.17 and later. This applies to the open‑source File Browser file‑management interface.

Risk and Exploitability

The CVSS score of 6.8 indicates a moderate severity. The EPSS score is below 1%, suggesting a very low likelihood of widespread exploitation at the moment. It is not listed in the CISA KEV catalog. The vulnerability can be exercised by simply uploading a backslash‑named file and may be leveraged by a threat actor with upload privileges to compromise files during extraction by other users.

Generated by OpenCVE AI on July 31, 2026 at 03:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade File Browser to version 2.63.17 or later to remove the backslash replacement logic.
  • If an upgrade cannot be performed immediately, configure the upload handler to reject filenames that contain backslashes or patterns such as '..\\'.
  • Modify the archive building code to sanitize filenames before writing them to the archive, ensuring the archive entry does not resolve outside the intended extraction directory.
  • If the archive feature is required, restrict extraction to trusted users or use a safe extraction utility that validates paths against the target directory.

Generated by OpenCVE AI on July 31, 2026 at 03:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-83xp-526h-j3ww File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
History

Wed, 15 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Filebrowser
Filebrowser filebrowser
Vendors & Products Filebrowser
Filebrowser filebrowser

Wed, 15 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 15 Jul 2026 16:00:00 +0000

Type Values Removed Values Added
Description File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.
Title File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
Weaknesses CWE-22
CWE-23
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N'}

Subscriptions

Filebrowser Filebrowser
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-15T16:32:21.438Z

Reserved: 2026-07-14T21:10:50.031Z

Link: CVE-2026-62843

cve-icon Vulnrichment

Updated: 2026-07-15T16:25:36.567Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T03:30:18Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-23

    Relative Path Traversal