CVE-2026-34530: File Browser Stored XSS Vulnerability

CVE-2026-34530 Overview

File Browser is a popular file managing interface that allows users to upload, delete, preview, rename, and edit files within a specified directory. Prior to version 2.62.2, the Single Page Application (SPA) index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. When an administrator sets the branding.name field to a malicious payload, persistent JavaScript is injected that executes for all visitors, including unauthenticated users.

Critical Impact

Administrative users can inject persistent JavaScript that affects ALL visitors to the File Browser instance, enabling session hijacking, credential theft, and malicious redirects even for unauthenticated users.

Affected Products

• File Browser versions prior to 2.62.2

Discovery Timeline

• 2026-04-01 - CVE-2026-34530 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34530

Vulnerability Analysis

This Stored Cross-Site Scripting vulnerability (CWE-79) exists in File Browser's handling of administrator-controlled branding configuration. The application fails to properly sanitize user-supplied input in the branding.name field before rendering it in the SPA index page.

The attack requires high privileges (administrator access) but has a significant blast radius due to the changed scope—malicious scripts execute in the browsers of all visitors to the application, including those who are not authenticated. This creates an opportunity for privilege escalation attacks where a compromised or malicious admin can target other administrators or harvest credentials from any visitor.

The vulnerability allows attackers to achieve high confidentiality impact through potential session token theft, combined with low integrity impact through content manipulation. The cross-site nature means the injected script runs in the context of the victim's browser session.

Root Cause

The root cause is insufficient input validation and output encoding in the branding configuration functionality. When administrators configure the branding.name setting, the application stores the raw input without sanitization and later renders it directly into the HTML of the SPA index page without proper encoding. This allows JavaScript code embedded in the branding name to execute when any user loads the page.

Attack Vector

The attack vector is network-based and requires an attacker to first obtain administrative access to the File Browser instance. Once authenticated as an admin, the attacker navigates to the branding settings and injects a malicious JavaScript payload into the branding.name field.

The payload is then stored persistently in the application's configuration and rendered on the index page for every subsequent visitor. The malicious script executes automatically when any user—authenticated or not—accesses the File Browser application, potentially stealing session cookies, redirecting users to phishing sites, or performing actions on behalf of authenticated users.

For technical implementation details and proof-of-concept information, refer to the GitHub Security Advisory GHSA-xfqj-3vmx-63wv.

Detection Methods for CVE-2026-34530

Indicators of Compromise

• Unusual or suspicious strings containing <script>, onerror=, onload=, or similar event handlers in branding configuration files
• Network traffic showing exfiltration of session tokens or cookies to external domains
• Unexpected changes to branding settings, particularly the branding.name field
• Browser console errors or unexpected JavaScript execution when loading File Browser

Detection Strategies

• Implement Content Security Policy (CSP) headers to detect and block unauthorized inline script execution
• Monitor application configuration files for modifications to branding settings
• Deploy web application firewalls (WAF) with XSS detection rules to identify malicious payloads
• Review audit logs for administrative changes to branding configuration

Monitoring Recommendations

• Enable detailed logging of all administrative configuration changes in File Browser
• Configure browser-based security monitoring to detect potential XSS execution patterns
• Set up alerts for configuration file modifications outside of normal maintenance windows
• Monitor for unusual outbound network connections originating from client browsers accessing the application

How to Mitigate CVE-2026-34530

Immediate Actions Required

• Upgrade File Browser to version 2.62.2 or later immediately
• Review current branding configuration settings for any suspicious or unexpected content
• Invalidate all active sessions after upgrading to prevent exploitation of potentially stolen session tokens
• Implement Content Security Policy headers to provide defense-in-depth against XSS attacks

Patch Information

The File Browser development team has addressed this vulnerability in version 2.62.2. The patch implements proper input sanitization and output encoding for the branding fields, preventing malicious JavaScript from being rendered in the page. Organizations should upgrade to this version or later to remediate the vulnerability.

For complete release information, see the GitHub Release v2.62.2.

Workarounds

• Restrict administrative access to trusted personnel only until the patch can be applied
• Review and sanitize existing branding configuration values manually, removing any HTML or JavaScript content
• Implement strict Content Security Policy (CSP) headers with script-src 'self' to block inline script execution
• Place the File Browser instance behind a reverse proxy with XSS filtering capabilities

# Example CSP header configuration for nginx
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;" always;