CVE-2026-34529 HIGH

CVE-2026-34529: File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

Vendor Filebrowser
Product filebrowser
Weakness CWE-79 · XSS
Published April 1, 2026
Last update April 2, 2026
View on NVD All CVEs

CVSS base score

7.6/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scripting (XSS). JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file. This issue has been patched in version 2.62.2.

Key dates

02Disclosure timeline

April 1, 2026 CVE published
April 2, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-31419 WordPress Churel plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability CVE-2024-34141 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) CVE-2025-32508 WordPress Course Booking System plugin <= 6.1.2 - Reflected Cross Site Scripting (XSS) Vulnerability CVE-2023-45144 Remote code execution from login screen through unescaped URL parameter in OAuth Identity XWiki App CVE-2024-7736 Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x