GO-2026-5411

vendorUSosv

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser

view advisory published 2026-06-25Licence: per source

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames in github.com/filebrowser/filebrowser

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2026-54093US	—	0.19% (9th)	—	2026-06-25
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the dow…

references

External citations — patches, advisories, analysis.

https://github.com/filebrowser/filebrowser/commit/847d08bdd135e5c3659f2e6dea2f0cd36617af9bFIX
https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6WEB
https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan