CVE-2026-62843: File Browser Path Traversal Vulnerability

CVE-2026-62843 Overview

CVE-2026-62843 is a path traversal vulnerability [CWE-22] in File Browser, an open-source web interface for managing files within a specified directory. The flaw affects versions 2.63.6 through 2.63.16 and resides in the archive builder logic. File Browser calls strings.ReplaceAll(nameInArchive, "\\", "/") when generating zip or tar archives. A user with upload permission can plant a file whose name contains backslashes, such as ..\..\evil.sh. The replacement converts the name into ../../evil.sh inside the archive. When another user downloads and extracts the archive, the malicious entry escapes the intended extraction directory. The issue is fixed in version 2.63.17.

Critical Impact
Authenticated users with upload permissions can craft archives that write files outside the extraction directory on victim systems, enabling arbitrary file overwrite on the downloading user's host.

Affected Products

File Browser versions 2.63.6 through 2.63.16
File Browser deployments exposing archive download features to multiple users
Shared File Browser instances where uploaders and downloaders differ in trust level

Discovery Timeline

2026-07-15 - CVE-2026-62843 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-62843

Vulnerability Analysis

The vulnerability lives in File Browser's archive generation code, specifically the raw.go HTTP handler that assembles zip and tar downloads. Filenames on POSIX systems can legally contain backslash characters, since only forward slash and NUL are reserved. File Browser accepts and stores these filenames without sanitization. During archive construction, the code normalizes path separators by replacing every backslash with a forward slash. This transformation converts an innocuous-looking POSIX filename like ..\..\evil.sh into the archive-level path ../../evil.sh, which archive extractors interpret as a directory traversal sequence. The attack requires the victim to download and extract the generated archive using a client that does not enforce path safety.

Root Cause

The root cause is unsafe path normalization applied after the filename enters trusted archive metadata. File Browser treats backslash-to-slash conversion as cosmetic, but the conversion creates traversal sequences that were not present in the on-disk filename. No validation rejects .. segments in the resulting archive entry name.

Attack Vector

An attacker authenticated with upload privileges creates a file whose POSIX name embeds backslash-separated traversal tokens. When another user requests an archive containing that file, the server emits an entry named ../../evil.sh. Upon extraction on the victim host, the file lands outside the destination folder and can overwrite scripts, configuration files, or shell startup files depending on write permissions.

// Patch: fix(raw): neutralize backslashes in archive entry names
// File: http/raw.go
 import (
 	"errors"
+	"fmt"
 	"io/fs"
 	"log"
 	"net/http"

Source: GitHub Commit 8503ba6

Detection Methods for CVE-2026-62843

Indicators of Compromise

Files on the File Browser storage volume whose names contain literal backslash characters, particularly combined with .. sequences
Generated zip or tar archives containing entries with ../ path segments
Extraction artifacts appearing outside expected download directories on client systems

Detection Strategies

Enumerate the File Browser data directory for filenames matching the pattern *\* or *..\* using shell globbing or find with regex predicates
Inspect archive contents server-side by listing entries with unzip -l or tar -tvf and flagging any entry beginning with ../ or containing /../
Audit File Browser access logs for upload requests followed by archive download requests from different user accounts

Monitoring Recommendations

Alert on file writes to sensitive paths (such as ~/.ssh/, ~/.bashrc, or system script directories) originating from archive extraction utilities
Track File Browser version strings across managed hosts and flag any instance running 2.63.6 through 2.63.16
Monitor for the creation of files with unusual character sets in shared upload directories

How to Mitigate CVE-2026-62843

Immediate Actions Required

Upgrade all File Browser instances to version 2.63.17 or later, which neutralizes backslashes in archive entry names
Audit existing uploads for filenames containing backslashes and remove or rename any suspicious entries before generating archives
Restrict upload permissions to trusted users until patching completes on shared instances

Patch Information

The fix is available in File Browser v2.63.17. The corresponding source change is commit 8503ba6, documented in GHSA-83xp-526h-j3ww. The patch modifies http/raw.go to sanitize archive entry names so that backslash characters do not produce traversal sequences.

Workarounds

Disable the archive download feature for multi-user instances until the patch is applied
Enforce a filename validation policy at the reverse proxy or upload middleware that rejects filenames containing backslash characters
Instruct users to extract downloaded archives with tools that reject traversal entries, such as recent versions of unzip with the -K behavior or bsdtar with --secure

bash

# Detect risky filenames before generating archives
find /path/to/filebrowser/data -name '*\\*' -print

# Inspect a generated archive for traversal entries
unzip -l download.zip | grep -E '(^|/)\.\./'
tar -tvf download.tar | grep -E '(^|/)\.\./'