Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/filebrowser/filebrowser/v2 | go | <= 2.63.5 | 2.63.6 |
| github.com/filebrowser/filebrowser | go | <= 1.11.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is a classic path traversal issue, also known as 'Zip-Slip'. It occurs in a two-step process. First, the resourcePostHandler function in http/resource.go allows an authenticated user to create a file with a specially crafted name containing backslashes and parent directory traversal sequences (e.g., ..\..\..\Windows\System32\evil.txt). This is possible because the function does not sanitize backslashes from the user-provided filename in the URL. Second, when a user requests to download a directory containing this malicious file as a zip or tar archive, the getFiles function in http/raw.go is called. This function fails to properly sanitize the backslashes from the filename before adding it to the archive. On a non-Windows server, the backslashes are preserved in the archive's file list. When the victim downloads and extracts this archive on a Windows machine, the operating system interprets the backslashes as path separators, causing the malicious file to be written outside of the intended extraction folder, leading to an arbitrary file write. The patch addresses the issue in the getFiles function by explicitly replacing all backslashes with forward slashes, thus neutralizing the path traversal attempt.
getFileshttp/raw.go
resourcePostHandlerhttp/resource.go