CVE-2026-34530CWE-79

File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

Medium · published April 1, 2026

CVSS v3.1
6.9
EPSS
0%
Percentile
28.2
In the wild
Unconfirmed
What it is

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. An admin who sets branding.name to a malicious payload injects persistent JavaScript that executes for ALL visitors, including unauthenticated users. This issue has been patched in version 2.62.2.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-01T20:41Z
EPSS history
Timeline
  • 01 APR 20:41Z
    File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection
    cvelistv5