CVE-2026-34529: File Browser EPUB Preview XSS Vulnerability

CVE-2026-34529 Overview

CVE-2026-34529 is a Stored Cross-Site Scripting (XSS) vulnerability affecting File Browser, a web-based file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored XSS attacks. JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file, potentially allowing attackers to steal session tokens, perform actions on behalf of authenticated users, or redirect victims to malicious sites.

Critical Impact

Attackers can execute arbitrary JavaScript in the context of authenticated user sessions by uploading malicious EPUB files, enabling session hijacking, data theft, and unauthorized actions within the File Browser interface.

Affected Products

• File Browser versions prior to 2.62.2
• Self-hosted File Browser deployments with EPUB preview enabled
• Any environment where users can upload and preview EPUB files

Discovery Timeline

• 2026-04-01 - CVE-2026-34529 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34529

Vulnerability Analysis

This vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) exists in File Browser's EPUB preview functionality. EPUB files are essentially ZIP archives containing HTML, CSS, and potentially JavaScript content. When a user previews an EPUB file within File Browser, the application renders the embedded content without proper sanitization, allowing malicious JavaScript to execute within the user's browser session.

The attack requires user interaction—specifically, a victim must preview the malicious EPUB file. However, since the malicious content is stored on the server (Stored XSS), any user who previews the file becomes a potential victim. This is particularly dangerous in shared environments where multiple users access the same File Browser instance.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output encoding when rendering EPUB file content for preview. The EPUB preview function fails to strip or neutralize embedded JavaScript and event handlers before presenting the content to users. Since EPUB files can contain legitimate HTML markup, the application must carefully balance functionality with security—a balance that was not properly achieved prior to version 2.62.2.

Attack Vector

The attack follows a straightforward exploitation path:

1. An attacker with upload privileges creates a malicious EPUB file containing embedded JavaScript payloads within the HTML content structure
2. The attacker uploads the crafted EPUB file to the File Browser instance
3. When any authenticated user previews the EPUB file, the embedded JavaScript executes in their browser context
4. The malicious script can access the victim's session, steal authentication tokens, modify displayed content, or perform actions on behalf of the victim

The network-based attack vector combined with the stored nature of the XSS payload makes this vulnerability particularly concerning for multi-user File Browser deployments where social engineering can trick users into previewing seemingly legitimate EPUB files.

Detection Methods for CVE-2026-34529

Indicators of Compromise

• Unusual EPUB files uploaded to File Browser containing embedded <script> tags or JavaScript event handlers
• Server logs showing repeated access to specific EPUB files followed by unexpected API calls or session anomalies
• Reports from users of unexpected behavior or redirects when previewing EPUB content
• Browser console errors or Content Security Policy violations related to EPUB preview functionality

Detection Strategies

• Implement Content Security Policy (CSP) headers to restrict inline script execution and detect XSS attempts
• Monitor file upload patterns for EPUB files, particularly from untrusted sources or containing suspicious metadata
• Deploy web application firewall (WAF) rules to inspect EPUB content for embedded JavaScript patterns
• Enable browser-based XSS auditors and review any triggered alerts in server logs

Monitoring Recommendations

• Log all EPUB preview events with user context to establish baseline behavior and detect anomalies
• Monitor for session token reuse from different IP addresses or user agents following EPUB preview activities
• Implement file integrity monitoring on uploaded EPUB files to detect post-upload modifications
• Review audit logs for privilege escalation or unauthorized actions following EPUB file access

How to Mitigate CVE-2026-34529

Immediate Actions Required

• Upgrade File Browser to version 2.62.2 or later immediately to address this vulnerability
• Audit existing EPUB files in the File Browser instance for embedded JavaScript content
• Consider temporarily disabling EPUB preview functionality until the patch is applied
• Review access logs for any suspicious EPUB preview activity that may indicate prior exploitation

Patch Information

The File Browser development team has addressed this vulnerability in version 2.62.2. The patch implements proper sanitization of EPUB content before rendering in the preview function. Organizations should update to this version or later to fully remediate the vulnerability. For detailed release information, see the GitHub Release v2.62.2. Additional technical details are available in the GitHub Security Advisory GHSA-5vpr-4fgw-f69h.

Workarounds

• Disable EPUB preview functionality entirely if upgrading is not immediately possible
• Implement strict Content Security Policy headers to block inline script execution (script-src 'self')
• Restrict file upload permissions to trusted users only until the patch is applied
• Use a reverse proxy or WAF to strip potentially malicious content from EPUB previews

# Example: Configure Content Security Policy header in nginx
# Add to your nginx configuration for File Browser
location / {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self';" always;
    # ... rest of your proxy configuration
}