GHSA-5vpr-4fgw-f69h

Source

https://github.com/advisories/GHSA-5vpr-4fgw-f69h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5vpr-4fgw-f69h/GHSA-5vpr-4fgw-f69h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5vpr-4fgw-f69h

Aliases

Published

2026-03-31T23:44:36Z

Modified

2026-06-25T18:56:18Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N CVSS Calculator

Summary

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file

Details

Summary

The EPUB preview function in File Browser is vulnerable to Stored Cross-site Scripting (XSS). JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file.

Details

frontend/src/views/files/Preview.vue passes allowScriptedContent: true to the vue-reader (epub.js) component:

// frontend/src/views/files/Preview.vue (Line 87)
:epubOptions="{
  allowPopups: true,
  allowScriptedContent: true,
}"

epub.js renders EPUB content inside a sandboxed

Database specific

{
    "cwe_ids":  [
        "CWE-79"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-31T23:44:36Z",
    "nvd_published_at":  "2026-04-01T21:17:00Z",
    "severity":  "HIGH"
}

References

Affected packages

Go / github.com/filebrowser/filebrowser/v2

Package

Name: github.com/filebrowser/filebrowser/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/filebrowser/filebrowser/v2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.62.2

Database specific

last_known_affected_version_range

"<= 2.62.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-5vpr-4fgw-f69h/GHSA-5vpr-4fgw-f69h.json"