Path traversal in FileBrowser - CVE-2026-62843
Published: July 6, 2026
Vulnerability identifier: #VU136929
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-62843
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to overwrite files outside the intended extraction directory.
The vulnerability exists due to path traversal in the archive builder when generating archive entry names from uploaded filenames containing backslashes. A remote user can upload a file with a crafted backslash-containing name and have it emitted into a downloaded archive as a traversal path to overwrite files outside the intended extraction directory.
User interaction is required to extract a downloaded archive, and the issue affects generated zip, tar, and related archive formats that use the shared archive entry name field.
Affected software
FileBrowser
How to mitigate CVE-2026-62843
Install security update from vendor's website.
FileBrowser - update to 2.63.17