CVE-2026-62843: File Browser Path Traversal Vulnerability via Backslash Filenames
Summary
CVE-2026-62843: File Browser: Archive builder turns backslash filenames into path traversal (zip-slip). Affects github.com/filebrowser/filebrowser/v2 versions >= 2.63.6, < 2.63.17. Fixed in 2.63.17. How to fix ↓
Also tracked for
The same CVE-2026-62843 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
File Browser is an open-source web application that allows users to manage files and directories through a web interface. It provides functionalities such as file uploads, downloads, and directory management. The application is built in Go and is widely used for its simplicity and ease of use. However, it has been found to be vulnerable to a path traversal issue, specifically when handling filenames that contain backslashes, which can lead to unauthorized file access on the server.
Vulnerability Detail
The vulnerability arises from a flaw in the archive builder of File Browser, where backslashes in filenames are replaced with forward slashes. This transformation creates a path traversal vector that allows an attacker to upload a file with a backslash in its name, which is treated as a valid filename on Linux systems. When the file is later downloaded as part of an archive, it can escape the intended extraction directory, potentially overwriting critical files on the victim's system. The issue was introduced as a fix for a previous vulnerability but inadvertently broadened the attack surface to include Linux and macOS systems. The CVSS score for this vulnerability is 6.8, indicating a moderate severity level.
How To Fix
Latest published version: v2.63.23 as of 22 Oct 2026
go get github.com/filebrowser/filebrowser/v2@v2.63.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.63.17
This is the first release that contains the fix.
go get github.com/filebrowser/filebrowser/v2@v2.63.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid uploading files with backslashes in their names. This can be enforced by implementing filename validation in the upload functionality, ensuring that any filenames containing backslashes are rejected. Here is an example of how to implement this check in Go:
if strings.Contains(filename, "\\") {
return errors.New("Invalid filename: backslashes are not allowed")
}
Conclusion
The CVE-2026-62843 vulnerability in File Browser poses a significant risk due to its ability to facilitate path traversal through backslash filenames. Users are strongly advised to update to the latest version to mitigate this risk and implement filename validation to prevent exploitation.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
The vulnerability allows for path traversal through the use of backslash characters in filenames, which can lead to unauthorized file access on the server.
Any user of File Browser who has upload permissions can potentially exploit this vulnerability, affecting anyone who downloads the compromised archives.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, ensure that no files with backslashes in their names are uploaded to the server as a temporary measure.
Exploiting this vulnerability can lead to overwriting critical files on the victim's system, which may result in data loss or code execution.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
