CVE-2026-62843
Deferred Deferred - Pending Action

Path Traversal in File Browser Archive Extraction

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-08-05
AI Q&A
2026-07-15
EPSS Evaluated
2026-08-03
NVD
CVE-2026-62843
EUVD
EUVD-2026-44707

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
filebrowser filebrowser From 2.63.6 (inc) to 2.63.16 (inc)
filebrowser filebrowser 2.63.17

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62843 is a path traversal vulnerability in FileBrowser versions 2.63.6 to 2.63.16. It occurs because the software replaces backslashes in filenames with forward slashes during archive creation. This turns a filename like ..\..\evil.sh into ../../evil.sh, allowing an attacker with upload permission to place files outside the intended directory when someone extracts the archive.

Detection Guidance

To detect this vulnerability, check if your FileBrowser instance is running version 2.63.6 to 2.63.16. Use commands like 'filebrowser version' or inspect the running process to verify the version. Monitor for unusual file creation or extraction patterns in user-uploaded archives.

Impact Analysis

An attacker could overwrite existing files or plant malicious files on your system by tricking you into extracting a specially crafted archive. This could lead to code execution, data corruption, or other malicious activities if the extracted files are used by your system or applications.

Compliance Impact

This vulnerability could lead to unauthorized file access or modification, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Compliance may be impacted if sensitive data is exposed or altered due to the path traversal flaw.

Mitigation Strategies

Upgrade FileBrowser to version 2.63.17 or later immediately. Remove the backslash-to-slash replacement in archive handling and implement stricter validation to reject backslashes and traversal sequences during file creation and archive generation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62843. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart