File Browser Stored Cross-Site Scripting Vulnerability in Branding Injection

A stored cross-site scripting vulnerability has been identified in File Browser versions through 2.62.1. The issue arises on the single-page application (SPA) index page, where admin-controlled branding fields are rendered without proper HTML escaping. An admin can inject a malicious script into the 'branding.name' field, which then executes for all users, including those who are unauthenticated.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user visiting the page. This affects all users, including those who are not logged in.

Reproduction

To reproduce this vulnerability, log into File Browser as an admin. Once authenticated, navigate to the settings and inject a script payload into the 'branding.name' field. After saving the changes, the injected script will execute when the SPA index page is loaded, demonstrating the cross-site scripting vulnerability.

Remediation

Users can upgrade to File Browser version 2.62.2 or later, where this vulnerability has been patched.