CVE-2026-54093
Description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, filebrowser builds the download-as-zip / download-as-tar archive entry names with filepath.ToSlash, which on a Linux host is a no-op for backslashes (\ is only a path separator on Windows). A file whose name contains Windows-style traversal is accepted by the resource handlers, stored on the Linux filesystem with a literal backslash name, and then emitted verbatim as the archive entry name. Windows extractors interpret \ as a path separator and write the extracted file outside the extraction directory — arbitrary file write on the victim who downloads and extracts the archive. This vulnerability is fixed in 2.63.6.
Summary dbcve.org
File Browser versions before 2.63.6 fail to sanitize archive entry names when creating zip/tar downloads. On Linux hosts, filepath.ToSlash leaves Windows-style backslashes untouched. Files with malicious names containing path traversal (e.g., '..\..\etc\passwd') are stored literally, then emitted verbatim into archives. Windows archive extractors interpret backslashes as path separators, allowing extraction outside the target directory—arbitrary file write on victims.
Mitigation
Upgrade File Browser to version 2.63.6 or later. If immediate upgrade is not possible, disable or restrict the archive download feature until the patch can be applied.