CVE-2026-62843 File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)
An attacker with upload permissions can create files with backslashes that become path traversal entries in archives, allowing arbitrary file write upon extraction.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-62843?
CVE-2026-62843 is a medium-severity path traversal vulnerability in filebrowser, published on 15 Jul 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.63.6 to 2.63.16, File Browser's archive builder uses strings.ReplaceAll(nameInArchive, "\", "/"), which turns a POSIX filename such as ..\..\evil.sh into the archive entry ../../evil.sh, allowing a user with upload permission to plant a backslash-named file that escapes the extraction directory when another user downloads and extracts the generated zip or tar archive. This issue is fixed in version 2.63.17.
Which versions are affected by CVE-2026-62843?
4 open source packages ship an affected version, including github.com/filebrowser/filebrowser/v2 and github.com/filebrowser/filebrowser.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser/v2 Go | From 2.63.6 | 2.63.17 |
github.com/filebrowser/filebrowser/v2 Go | From 2.63.6 | 2.63.17 |
github.com/filebrowser/filebrowser/v2 Go | From 2.63.6 | 2.63.17 |
github.com/filebrowser/filebrowser Go | All versions | None |
How do I fix CVE-2026-62843?
Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.17 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-62843 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-62843 exists.
Sources
Also known as GHSA-83xp-526h-j3ww, GO-2026-6026.