Stored Cross-Site Scripting Vulnerability in File Browser by File Browser
CVE-2026-34530

6.9MEDIUM

Key Information:

Vendor

Filebrowser

Status
Filebrowser
Vendor
CVE Published:
1 April 2026

What is CVE-2026-34530?

File Browser, a versatile file management interface, is susceptible to a Stored Cross-Site Scripting vulnerability prior to version 2.62.2. This flaw allows administrators to inject a persistent JavaScript payload through the branding fields. Once an admin sets 'branding.name' with malicious code, it executes for all visitors, including those who are unauthenticated. The issue has been addressed in version 2.62.2, prompting users to update to safeguard their applications.

Affected Version(s)

filebrowser < 2.62.2

References

https://github.com/filebrowser/filebrowser/security/advis...
x_refsource_CONFIRM
https://github.com/filebrowser/filebrowser/releases/tag/v...
x_refsource_MISC

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.