CVE-2026-34530: 
NixOS vulnerability analysis and mitigation

CVE-2026-34530 is a Stored Cross-Site Scripting (XSS) vulnerability in File Browser (filebrowser/filebrowser) affecting all versions up to and including v2.62.1. The flaw allows an administrator to inject persistent JavaScript into the SPA index page via admin-controlled branding fields, which then executes for all visitors — including unauthenticated users. It was published to the GitHub Advisory Database on March 31, 2026, and to the NVD on April 1, 2026. It carries a CVSS v3.1 base score of 6.9 (Medium) (GitHub Advisory, GitHub Security Advisory).

The root cause (CWE-79) is that http/static.go renders the SPA index.html using Go's text/template package instead of the safer html/template, which means no automatic HTML escaping is applied to template variables. Branding fields such as branding.name, branding.color, and ReCaptchaHost are passed directly into the HTML template with custom delimiters [{[ and ]}], allowing an admin to set branding.name to a payload like </title><script>alert(1)</script> to break out of the <title> tag and inject arbitrary JavaScript. Additionally, the ReCaptchaHost field is used as the src attribute of a <script> tag, enabling loading of arbitrary JavaScript from an admin-chosen origin. The absence of a Content-Security-Policy (CSP) header on the SPA entry point removes any browser-level mitigation (GitHub Advisory, GitHub Security Advisory).

Successful exploitation results in persistent JavaScript execution for every visitor to the File Browser instance, including unauthenticated users, until an administrator manually removes the malicious branding setting. An attacker with admin access (or who has compromised an admin account) can leverage this to steal session tokens and credentials from all users, redirect visitors to malicious sites, perform actions on behalf of authenticated users, or establish a persistent client-side backdoor. The confidentiality impact is rated High due to the potential for credential and session data theft, with a Low integrity impact from the ability to manipulate page content (GitHub Advisory, GitHub Security Advisory).

A public proof-of-concept (PoC) Python script is available in the GitHub Security Advisory, demonstrating the full attack chain from admin authentication through payload injection and verification of unescaped rendering in the SPA HTML. The PoC is classified as real exploit code but does not achieve full system compromise — it demonstrates the bug by injecting and confirming execution of arbitrary JavaScript. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.057% (0.035% per GitHub Advisory), placing it in a low exploitation probability tier (GitHub Advisory, GitHub Security Advisory).

1. Reconnaissance: Identify a target File Browser instance running version <= 2.62.1, accessible over the network (e.g., via Shodan or direct discovery).
2. Obtain admin credentials: Acquire valid admin credentials through phishing, credential stuffing, or prior compromise of the admin account.
3. Authenticate: Send a POST request to /api/login with the admin username and password to obtain an authentication token.

   POST /api/login
   {"username": "admin", "password": "<password>"}

4. Retrieve current settings: Send a GET request to /api/settings with the X-Auth header set to the obtained token to retrieve the current application settings JSON.
5. Inject XSS payload: Modify the branding.name field in the settings JSON to a malicious payload (e.g., </title><script>alert("XSS")</script>) and submit it via a PUT request to /api/settings.

   PUT /api/settings
   X-Auth: <token>
   {"branding": {"name": "</title><script>alert('XSS')</script>", ...}}

6. Verify injection: Fetch the SPA root (GET /) without authentication and confirm the payload appears unescaped in the HTML response within the <title> tag context.
7. Persistent execution: Every subsequent visitor (authenticated or not) who loads the File Browser index page will execute the injected JavaScript, enabling credential harvesting, session hijacking, or redirection to attacker-controlled infrastructure (GitHub Advisory, GitHub Security Advisory).

• Network: Unexpected PUT requests to /api/settings from unusual IP addresses or at unusual times; outbound connections from users' browsers to unknown external domains (if ReCaptchaHost is abused to load external scripts).
• Logs: Application access logs showing PUT /api/settings requests containing HTML/script tags or encoded equivalents in the request body; repeated GET / requests from diverse IPs following a settings change.
• File System / Configuration: The branding.name, branding.color, or ReCaptchaHost fields in the File Browser settings database or configuration file containing <script>, </title>, JavaScript URIs, or unexpected external URLs.
• Browser / Client-Side: Unexpected JavaScript alert dialogs or console errors when loading the File Browser index page; browser developer tools showing inline <script> tags in the <title> context of the SPA HTML response (GitHub Advisory).

The fix is available in File Browser version 2.62.2, which replaces text/template with html/template in http/static.go (commit d9f9460), ensuring all branding fields are HTML-escaped before rendering. Organizations should upgrade to v2.62.2 or later immediately (v2.62.2 Release). If immediate patching is not possible, restrict admin account access to trusted users only, audit admin accounts for unauthorized activity, and monitor the /api/settings endpoint for suspicious PUT requests. Additionally, deploying a Web Application Firewall (WAF) to detect and block script injection patterns in settings API requests, and reviewing existing branding settings for injected payloads, are recommended interim steps (GitHub Advisory).