Go/github.com/filebrowser/filebrowser CVE-2026-54093: medium 6.8, EPSS 0.19%

File Browser: FilePath traversal in download-as-zip/tar via Windows-style backslash separators in stored filenames

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-gxjx-7m74-hcq8#Go/github.com/filebrowser/filebrowser
• nvd: CVE-2026-54093
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-gxjx-7m74-hcq8
• https://github.com/filebrowser/filebrowser/commit/847d08bdd135e5c3659f2e6dea2f0cd36617af9b
• https://github.com/filebrowser/filebrowser
• https://github.com/filebrowser/filebrowser/releases/tag/v2.63.6

CVE-2026-54093 · published 2026-06-12T21:53:18Z · modified 2026-06-25T23:11:15.812254269Z · JSON