文件浏览器存在通过 text/template 品牌注入实现的存储型跨站脚本漏洞

该XSS漏洞的潜在影响非常严重。攻击者可以利用此漏洞执行任意JavaScript代码，从而窃取用户凭据、会话cookie，或进行其他恶意活动。由于branding.name字段影响所有访问者，包括未认证用户，因此该漏洞的攻击范围非常广。攻击者可以利用此漏洞进行钓鱼攻击，窃取敏感信息，甚至完全控制受感染的File Browser实例。类似XSS攻击，攻击者可以利用此漏洞进行信息窃取和恶意代码执行。

File Browser installations where administrators have access to modify branding settings are at risk. This includes shared hosting environments where multiple users may share a single File Browser instance and one administrator could compromise the entire system. Legacy File Browser deployments running older, unpatched versions are particularly vulnerable.

• linux / server: Examine File Browser configuration files for suspicious JavaScript code in the branding.name field. Use grep to search for potentially malicious payloads.

grep -r 'alert(' /path/to/filebrowser/config.yml

• generic web: Monitor File Browser access logs for requests to modify the branding configuration. Look for unusual user agents or IP addresses.

curl -I http://your-filebrowser-instance/branding

• wordpress / composer / npm: (Not applicable, as File Browser is not a WordPress plugin or Node.js package) • database (mysql, redis, mongodb, postgresql): (Not applicable, as File Browser does not directly store branding information in a database) • windows / supply-chain: (Not applicable, as File Browser is not a Windows application)

1. 2026-03-31Disclosure

   disclosure

1. 已保留2026-03-30
2. 发布日期2026-03-31
3. 修改日期2026-04-06
4. EPSS 更新日期2026-04-09

修复此漏洞的首要措施是立即升级至 filebrowser/filebrowser/v2 2.62.2 或更高版本。如果无法立即升级，可以考虑以下缓解措施：首先，严格审查和验证所有管理员设置的branding字段，避免包含任何可疑字符。其次，如果可能，限制对File Browser管理界面的访问，只允许授权用户进行配置。此外，可以考虑使用Web应用防火墙（WAF）来过滤恶意payload，并定期扫描File Browser实例，以检测潜在的攻击迹象。升级后，请确认新版本已正确安装并配置，并且branding字段没有被恶意篡改。