CVE-2026-34530: File Browser vulnerable to Stored Cross-site Scripting via text/template branding injection

March 31, 2026 (updated April 6, 2026)

The SPA index page in File Browser is vulnerable to Stored Cross-site Scripting (XSS) via admin-controlled branding fields. An admin who sets branding.name to a malicious payload injects persistent JavaScript that executes for ALL visitors, including unauthenticated users.

References

github.com/advisories/GHSA-xfqj-3vmx-63wv
github.com/filebrowser/filebrowser
github.com/filebrowser/filebrowser/releases/tag/v2.62.2
github.com/filebrowser/filebrowser/security/advisories/GHSA-xfqj-3vmx-63wv
nvd.nist.gov/vuln/detail/CVE-2026-34530

Code Behaviors & Features

Detect and mitigate CVE-2026-34530 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →