CVE-2026-54093

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.63.6

Description An issue exists where the software fails to properly normalize file paths when creating zip or tar archives on Linux hosts. Specifically, the getFiles() function uses filepath.ToSlash, which does not convert backslashes on Linux. This allows an authenticated user with create permissions to upload files containing Windows-style traversal sequences (e.g., ....) in the filename. These filenames are stored literally on the Linux filesystem and then included verbatim in the generated archive.

When a victim downloads and extracts such an archive using Windows-based extractors (such as Windows Explorer, 7-Zip, or WinRAR), the backslashes are interpreted as path separators. This leads to an arbitrary file write, allowing files to be written outside the intended extraction directory on the victim's machine.

Recommendations Update to version 2.63.6. As a temporary mitigation, restrict the Create permission for untrusted users to prevent the upload of files with malicious filenames.