Go/github.com/filebrowser/filebrowser/v2 CVE-2026-62843: medium 6.8, EPSS 0.39%

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.17 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.17

Affected

Fixed versions

Sources

• osv: GHSA-83xp-526h-j3ww
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-83xp-526h-j3ww
• https://nvd.nist.gov/vuln/detail/CVE-2026-62843
• https://github.com/filebrowser/filebrowser/commit/8503ba61ff51d48a7313896483d130eb6a5abfe0
• https://github.com/filebrowser/filebrowser
• https://github.com/filebrowser/filebrowser/releases/tag/v2.63.17

CVE-2026-62843 · published 2026-07-20T22:16:09Z · modified 2026-07-22T21:11:44.557134742Z · JSON