EUVD-2026-278797

fkie_cve-2026-34529

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scripting (XSS). JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file. This issue has been patched in version 2.62.2.

GHSA-5vpr-4fgw-f69h — File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

Affected: Go: github.com/filebrowser/filebrowser/v2

### Summary

The EPUB preview function in File Browser is vulnerable to Stored Cross-site Scripting (XSS). JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file.

### Details

`frontend/src/views/files/Preview.vue` passes `allowScriptedContent: true` to the `vue-reader` (epub.js) component: ```js // frontend/src/views/files/Preview.vue (Line 87) :epubOptions="{ allowPopups: true, allowScriptedContent: true, }" ``` epub.js renders EPUB content inside a sandboxed <iframe> with srcdoc. However, the sandbox includes both allow-scripts and allow-same-origin, which [renders the sandbox ineffective](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#allow-top-navigation-to-custom-protocols) — the script can access the parent frame's DOM and storage.

The epub.js developers explicitly [warn against enabling scripted content](https://github.com/futurepress/epub.js?tab=readme-ov-file#scripted-content).

### PoC I've crafted the PoC python script that could be ran on test environment using docker compose:

```yaml services:

filebrowser: image: filebrowser/filebrowser:v2.62.1 user: 0:0 ports: - "80:80" ```

And running this PoC python script: ```python import argparse import io import sys import zipfile import requests

BANNER = """ Stored XSS via EPUB PoC Affected: filebrowser/filebrowser <=v2.62.1 Root cause: Preview.vue -> epubOptions: { allowScriptedContent: true } Related: CVE-2024-3523…

Most recent entries from all

EUVD-2026-278797

fkie_cve-2026-34529

GHSA-5vpr-4fgw-f69h — File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file