Executive brief
File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser
Affected products
- Go github.com/filebrowser/filebrowser
- Go github.com/filebrowser/filebrowser/v2
Junglewise Threat Intelligence
CVE-2026-34529: GO-2026-5156 - File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser
CVE-2026-34529 · Severity: low · CVSS 3.1 · Published 2026-06-25
Technologies: github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: Go.
Related threats
- File Browser sensitive information disclosure in Share API
- File Browser path traversal in archive builder via backslash filenames
- File Browser directory traversal and isolation bypass via username normalization collision
- File Browser path traversal via dangling symlink in ScopedFs
- GO-2026-5754 - File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection in github.com/filebrowser/filebrowser