Is CVE-2026-54093 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54093 being exploited in the wild.

How severe is CVE-2026-54093?

Medium severity, with a CVSS score of 4, published 25 June 2026.

Which products and versions are affected?

File Browser < 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.

Is there a fix for CVE-2026-54093?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54093 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54093?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54093: File Browser path traversal in archive download via backslash separators

Q: Which products and versions are affected?

File Browser < 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.

Q: Is there a fix for CVE-2026-54093?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54093 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54093?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54093 · Severity: medium · CVSS 4 · Published 2026-06-25

File Browser is a web-based file management interface used to upload, edit, and share files. A vulnerability exists where an attacker can upload a file with a specially crafted name that, when downloaded as part of a ZIP or TAR archive by another user on a Windows computer, can write files to unintended locations on the victim's machine. This could allow an attacker to overwrite system files or place malicious software in startup folders if a victim extracts a downloaded archive.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-54093 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54093 being exploited in the wild.
How severe is CVE-2026-54093?: Medium severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?: File Browser < 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.
Is there a fix for CVE-2026-54093?: Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54093 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54093?: Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later
```
go get github.com/filebrowser/filebrowser/v2@v2.63.6
```

Technical details

A path traversal vulnerability exists in File Browser's archive generation logic (download-as-zip/tar). When running on a Linux host, the application uses 'filepath.ToSlash' to normalize entry names; however, on Linux, this function does not convert backslashes (\) as they are not considered path separators. An authenticated attacker can upload a file with a name containing Windows-style traversal sequences (e.g., '..\..\'). When a victim downloads a folder containing this file as an archive and extracts it on a Windows system, the extraction utility interprets the backslashes as directory separators, writing the file outside the intended extraction directory. This is fixed in version 2.63.6 by ensuring backslashes are normalized regardless of the host operating system.

Affected products

filebrowser filebrowser < 2.63.6

Identifiers

CVE-2026-54093
GHSA-gxjx-7m74-hcq8
GO-2026-5411

Timeline

2026-06-06: advisory: GitHub Security Advisory published
2026-06-25: disclosed: NVD publication date

References

https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.