6.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34530

CVE-2026-34530: File Browser is vulnerable to Stored Cross-Site Scripting via text/template branding injection

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. An admin who sets branding.name to a malicious payload injects persistent JavaScript that executes for ALL visitors, including unauthenticated users. This issue has been patched in version 2.62.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34530

CVE-2026-34530:

6.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/filebrowser/filebrowser/v2	go	<= 2.62.1	2.62.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the http/static.go file where the Go text/template package was used to render the application's main page. The text/template package does not perform any HTML escaping, which allowed for a stored Cross-site Scripting (XSS) vulnerability. An administrator could set a malicious payload in the branding.name setting. This payload, containing JavaScript, would then be rendered unescaped in the <title> tag of the HTML page for all visitors. The fix was to switch to the html/template package, which provides automatic, context-aware escaping of data. The commit d9f9460c1e51d10a25065e10358c12d5ced66ad9 shows this change. Additionally, commit c406bda0c73ac8b187e23a97c05521edc77efa84 further hardens the fix by using template.JS to safely embed JSON data into the page within the handleWithStaticData function. Therefore, fbhttp.handleWithStaticData is the primary vulnerable function.

Vulnerable functions

fbhttp.handleWithStaticData

http/static.go

The function `handleWithStaticData` was vulnerable to stored XSS because it used `text/template` instead of `html/template` to render the main page. This allowed an administrator to inject malicious JavaScript into the branding settings, which would then be executed in the browser of any user visiting the site. The patch replaces `text/template` with `html/template` and uses `template.JS` to ensure that the data is properly escaped.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.