CVE-2026-34530

MEDIUM

File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

Title source: cna

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. An admin who sets branding.name to a malicious payload injects persistent JavaScript that executes for ALL visitors, including unauthenticated users. This issue has been patched in version 2.62.2.

References (2)

Scores

CVSS v3 6.9
EPSS 0.0006
EPSS Percentile 19.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

Details

CWE
CWE-79
Status published
Products (2)
filebrowser/filebrowser < 2.62.2 (2 CPE variants)
filebrowser/filebrowser 0 - 2.62.2Go
Published Apr 01, 2026
Tracked Since Apr 02, 2026