CVE-2026-34530 MEDIUM

CVE-2026-34530: File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

Vendor Filebrowser
Product filebrowser
Weakness CWE-79 · XSS
Published April 1, 2026
Last update April 4, 2026
View on NVD All CVEs

CVSS base score

6.9/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction Required
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

What the vulnerability does

01Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. An admin who sets branding.name to a malicious payload injects persistent JavaScript that executes for ALL visitors, including unauthenticated users. This issue has been patched in version 2.62.2.

Key dates

02Disclosure timeline

April 1, 2026 CVE published
April 4, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2019-25244 Legrand BTicino Driver Manager F454 1.0.51 CSRF and Stored XSS Vulnerabilities CVE-2024-8653 Netcat CMS: multiple reflected cross-site scripting vulnerabilities in netshop module CVE-2026-6600 langflow-ai langflow Frontend React Component Rendering edit-message.tsx cross site scripting CVE-2026-0561 Shield Security <= 21.0.8 - Unauthenticated Reflected Cross-Site Scripting via 'message' Parameter CVE-2024-37549 WordPress Save as PDF plugin by Pdfcrowd plugin <= 4.0.0 - Cross Site Scripting (XSS) vulnerability