Executive Summary

CVE-2026-54093 is a path traversal vulnerability in the filebrowser application affecting versions up to 2.63.5. The issue occurs because Windows-style backslash separators in filenames are not properly normalized on Linux systems. The filepath.ToSlash function does not convert backslashes to forward slashes on Linux, so filenames containing backslashes are stored literally.

When a user downloads a folder as a ZIP or TAR archive and extracts it on a Windows system, the backslashes in filenames are interpreted as path separators. This allows files to be extracted outside the intended directory, enabling arbitrary file writes outside the extraction folder.

This vulnerability can be exploited by any authenticated user with Create permission (or anonymous users on signup-enabled instances) to plant malicious files that compromise the systems of users who download and extract the archives on Windows.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to arbitrary file writes outside the intended extraction directory on Windows systems when users extract downloaded archives. An attacker can exploit this to overwrite critical system files or executables.

As a result, the attacker may compromise the victim's system by planting malicious files, potentially leading to system instability, unauthorized code execution, or further security breaches.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves malicious filenames containing Windows-style backslash path separators stored on a Linux filesystem by the filebrowser application. Detection involves identifying files with backslashes (\) in their names within directories managed by filebrowser, especially if these files are included in ZIP or TAR archives for download.

On Linux systems, you can use commands to find files with backslashes in their names, for example:

• find /path/to/filebrowser/root -name '*\\*'

This command searches recursively for files whose names contain a backslash character. Such files may be indicators of exploitation or attempts to exploit the vulnerability.

Additionally, monitoring downloads of ZIP or TAR archives from filebrowser and inspecting their contents for entries with backslashes in their names can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade the filebrowser application to version 2.63.6 or later, where this vulnerability is fixed by normalizing Windows-style path separators in archive entry names regardless of the host OS.

Until the upgrade can be applied, consider restricting user permissions to prevent unauthorized file creation or modification, especially limiting Create permissions to trusted users only.

Also, educate users to be cautious when downloading and extracting archives from filebrowser, particularly on Windows systems, to avoid extracting files outside intended directories.

Useful 0 Not Useful 0