CVE-2026-34529 is a high severity (CVSS 7.6) stored cross-site scripting flaw in File Browser's EPUB preview. JavaScript in a crafted EPUB runs in the browser of anyone who previews it. The fix is version 2.62.2, so upgrade to it or later.
What's affected
The project's advisory (GHSA-5vpr-4fgw-f69h) lists the Go module github.com/filebrowser/filebrowser/v2 at 2.62.1 and earlier, patched in 2.62.2.
The cause is in the preview view, which enables scripted content for the EPUB reader. The reader renders the book in a sandboxed frame, but the sandbox allows both scripts and same-origin access, which cancels its protection, so the script can reach the parent page.
The same release also fixes CVE-2026-34528.
How to check if you're exposed
filebrowser version
Compare with 2.62.2. Also check who can upload files. The attack needs someone to place a crafted EPUB where another user, ideally an administrator, will preview it.
Scan the file list for EPUB files uploaded by users you do not know, and avoid opening them in the preview until the upgrade is done.
What to do now
- Upgrade to 2.62.2 or later.
- Do not preview EPUB files from unknown sources.
- Limit upload rights to people you trust.
- Sign out and back in after the upgrade.
Why it matters
The weakness is CWE-79, cross-site scripting. A sandbox that allows scripts and same-origin access together gives the content the same rights as the host page, so it is a sandbox in name only.
Stored XSS in a file manager is serious because the victim is often an administrator and the page holds an active session. The record does not mark this CVE as exploited, and it is not on the CISA KEV list.
When you embed untrusted content in an iframe, never combine the allow-scripts and allow-same-origin sandbox flags. Together they let the framed page remove its own sandbox. Serve untrusted documents from a separate origin where possible.
Quick check
Why was the sandbox ineffective?
It allowed scripts and same-origin access together, so embedded script could reach the parent page.
Sources
Last reviewed: 19 October 2026.
