filebrowser allows Stored Cross-Site Scripting through the Markdown preview function
Date: 2025-06
Affected: go/github.com/filebrowser/filebrowser, go/github.com/filebrowser/filebrowser/v2
Attack vector: xss
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2025-52902
CWE: CWE-79
CVSS: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N)

## Summary ## The Markdown preview function of File Browser v2.32.0 is vulnerable to *Stored Cross-Site-Scripting (XSS)*. Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser ## Impact ## A user can upload a malicious Markdown file to the application which can contain arbitrary HTML code. If another user within the same scope clicks on that file, a rendered preview is opened. JavaScript code that has been included will be executed. Malicious actions that are possible include: * Obtaining a user's session token * Elevating the attacker's privileges, if the victim is an administrator (e.g., gaining command execution rights) ## Vulnerability Description ## Most Markdown parsers accept arbitrary HTML in a document and try rendering it accordingly. For instance, if one creates a file called `xss.md` with the following content: ```markdown # Hallo <b>foo</b> <img src="xx" onerror=alert(9)> <i>bar</i> ``` Bold and italic text will be rendered. Also, the renderer used in File Browser will try to display the image and execute the code in the `onerror` event handler. ## Proof of Concept ## The screenshot shows that the code from the file mentioned above has actually been executed in the victim's browser: ![JavaScript code being executed in the Markdown Preview](https://github.com/user-attachments/assets/3a3b9920-fbd8-433f-a016-ea77f5f68851) ## Recommended Countermeasures ## The most thorough fix would be to reconfi


Mitigations:

Architectural layers (MAESTRO):