Executive brief
File Browser is a web-based file management interface used to upload, edit, and share files. A vulnerability exists where an attacker can upload a file with a specially crafted name that, when downloaded as part of a ZIP or TAR archive by another user on a Windows computer, can write files to unintended locations on the victim's machine. This could allow an attacker to overwrite system files or place malicious software in startup folders if a victim extracts a downloaded archive.
Technical details
A path traversal vulnerability exists in File Browser's archive generation logic (download-as-zip/tar). When running on a Linux host, the application uses 'filepath.ToSlash' to normalize entry names; however, on Linux, this function does not convert backslashes (\) as they are not considered path separators. An authenticated attacker can upload a file with a name containing Windows-style traversal sequences (e.g., '..\..\'). When a victim downloads a folder containing this file as an archive and extracts it on a Windows system, the extraction utility interprets the backslashes as directory separators, writing the file outside the intended extraction directory. This is fixed in version 2.63.6 by ensuring backslashes are normalized regardless of the host operating system.
Affected products
- filebrowser filebrowser < 2.63.6
Timeline
- 2026-06-06: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date