# CVE-2026-54093: File Browser path traversal in archive download via backslash separators

Source: https://junglewise.ai/threats/cve-2026-54093-file-browser-path-traversal-in-archive-download-via-backslash  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-54093 · Severity: medium · CVSS 4 · Published 2026-06-25

File Browser is a web-based file management interface used to upload, edit, and share files. A vulnerability exists where an attacker can upload a file with a specially crafted name that, when downloaded as part of a ZIP or TAR archive by another user on a Windows computer, can write files to unintended locations on the victim's machine. This could allow an attacker to overwrite system files or place malicious software in startup folders if a victim extracts a downloaded archive.

Technologies: [File Browser](https://junglewise.ai/threats/technologies/file-browser), [github.com/filebrowser/filebrowser (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser), [github.com/filebrowser/filebrowser/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-filebrowser-filebrowser-v2). Vendors: [File Browser](https://junglewise.ai/threats/vendors/file-browser), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-54093 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54093 being exploited in the wild.

**How severe is CVE-2026-54093?** Medium severity, with a CVSS score of 4, published 25 June 2026.

**Which products and versions are affected?** File Browser < 2.63.6; github.com/filebrowser/filebrowser (Go) <= 1.11.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.11.0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.

**Is there a fix for CVE-2026-54093?** Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54093 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-54093?** Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later

  ```sh
  go get github.com/filebrowser/filebrowser/v2@v2.63.6
  ```


## Technical details

A path traversal vulnerability exists in File Browser's archive generation logic (download-as-zip/tar). When running on a Linux host, the application uses 'filepath.ToSlash' to normalize entry names; however, on Linux, this function does not convert backslashes (\) as they are not considered path separators. An authenticated attacker can upload a file with a name containing Windows-style traversal sequences (e.g., '..\..\'). When a victim downloads a folder containing this file as an archive and extracts it on a Windows system, the extraction utility interprets the backslashes as directory separators, writing the file outside the intended extraction directory. This is fixed in version 2.63.6 by ensuring backslashes are normalized regardless of the host operating system.

## Affected products

- filebrowser filebrowser < 2.63.6

## Identifiers

- CVE-2026-54093
- GHSA-gxjx-7m74-hcq8
- GO-2026-5411

## Timeline

- 2026-06-06: advisory: GitHub Security Advisory published
- 2026-06-25: disclosed: NVD publication date

## References

- [https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8](https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8)

## Related threats

- [File Browser symlink alias path traversal bypass](https://junglewise.ai/threats/cve-2026-90930-file-browser-symlink-alias-path-traversal-bypass)
- [File Browser authorization bypass in direct-upload endpoint](https://junglewise.ai/threats/cve-2026-90929-file-browser-authorization-bypass-in-direct-upload-endpoint)
- [File Browser subtitle conversion memory exhaustion](https://junglewise.ai/threats/cve-2026-90928-file-browser-subtitle-conversion-memory-exhaustion)
- [File Browser stale share link exposure in cross-user file deletion](https://junglewise.ai/threats/cve-2026-82236-file-browser-stale-share-link-exposure-in-cross-user-file)
- [File Browser path-based access control bypass in recursive operations](https://junglewise.ai/threats/cve-2026-73612-file-browser-path-based-access-control-bypass-in-recursive)