EUVD-2026-338075

fkie_cve-2026-62843

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.

GHSA-83xp-526h-j3ww — File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Affected: Go: github.com/filebrowser/filebrowser/v2

## Summary

The fix for `GHSA-gxjx-7m74-hcq8` / `CVE-2026-54093` (shipped in v2.63.6) added a `strings.ReplaceAll(nameInArchive, "\\", "/")` step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it with the real POSIX separator `/` **manufactures** a `/`-delimited traversal sequence out of a benign single file name. The fix neutralized the Windows-only vector but reintroduced the same class of bug on POSIX systems, and the advisory's "Secondary Mitigation" (reject backslash filenames at creation time) was never implemented, so the malicious file can still be planted.

A file named `..\..\evil.sh`, one ordinary regular file on a Linux server, is emitted into generated zip/tar archives as the entry `../../evil.sh`. Any user with upload (Create) permission can plant such a file; when anyone later downloads the containing folder as an archive and extracts it, the entry escapes the extraction directory on the victim's machine. The original advisory's own payload `..\..\..\Windows\System32\evil.txt` now becomes `../../../Windows/System32/evil.txt`, which, unlike before the fix, also traverses on Linux and macOS extractors. The fix turned a Windows-only zip-slip into a cross-platform one.

## Details

**1. The archive builder rewrites backslashes into path separators (`http/raw.go:133`)**

```go nameInArchive := strings.TrimPrefix(path, commonPath) nameInArchive = string…

Most recent entries from all

EUVD-2026-338075

fkie_cve-2026-62843

GHSA-83xp-526h-j3ww — File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)