File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue.

Affected: Go: github.com/filebrowser/filebrowser/v2, Go: github.com/filebrowser/filebrowser

## Summary ##

The Markdown preview function of File Browser v2.32.0 is vulnerable to *Stored Cross-Site-Scripting (XSS)*. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser

## Impact ##

A user can upload a malicious Markdown file to the application which can contain arbitrary HTML code. If another user within the same scope clicks on that file, a rendered preview is opened. JavaScript code that has been included will be executed.

Malicious actions that are possible include: * Obtaining a user's session token * Elevating the attacker's privileges, if the victim is an administrator (e.g., gaining command execution rights)

## Vulnerability Description ##

Most Markdown parsers accept arbitrary HTML in a document and try rendering it accordingly. For instance, if one creates a file called `xss.md` with the following content:

```markdown # Hallo

<b>foo</b>

<img src="xx" onerror=alert(9)> <i>bar</i> ```

Bold and italic text will be rendered. Also, the renderer used in File Browser will try to display the image and execute the code in the `onerror` event handler.

## Proof of Concept ##

The screenshot shows that the code from the file mentioned above has actually been executed in the victim's browser:


## Recommended Countermeasures ##

The most thorough fix would be to reconf…

govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media