Project

General

Profile

Actions
Copy link

Bug #16918

closed
JP JP

Potential stored XSS in ``browser.php`` used by ``diag_edit.php``

Bug #16918: Potential stored XSS in ``browser.php`` used by ``diag_edit.php``

Added by Jim Pingle 3 months ago. Updated about 1 month ago.

Status:
Resolved
Priority:
Normal
Assignee:
Jim Pingle
Category:
Diagnostics
Target version:
2.9.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
26.07
Release Notes:
Default
Affected Version:
Affected Architecture:

Description

The file browser component of diag_edit.php at /usr/local/www/vendor/filebrowser/browser.php has a potential stored XSS in its handling of directory names.

Directory names are used in JavaScript with partial encoding that can still be leveraged for XSS.

If an attacker with the ability to create arbitrary directories on the filesystem can create a directory with a specially-crafted name and then an administrator navigates to that directory when browsing files to edit, it could trigger an XSS.

An example of a problematic directory is:

payload');alert(1);if('a'=='a

Files

16918.patch (776 Bytes) 16918.patch Jim Pingle, 06/29/2026 05:29 PM

JP Updated by Jim Pingle 3 months ago Actions
Copy link
 #1

Fixed in commit 345e04c9bb8221240020a79972c00db8507271ea

Fixed encoding to be safe for JavaScript

Patch is attached.

JP Updated by Jim Pingle 2 months ago Actions
Copy link
 #2

  • Plus Target Version changed from 26.11 to 26.07

GT Updated by Georgiy Tyutyunnik about 2 months ago Actions
Copy link
 #4

  • Status changed from Feedback to Resolved

can't reproduce in the latest dev
tested on:
26.07-BETA (amd64)
built on Mon Jul 27 14:43:00 UTC 2026
FreeBSD 16.0-CURRENT

JP Updated by Jim Pingle about 1 month ago Actions
Copy link
 #5

  • Private changed from Yes to No
Actions
Copy link

Also available in: Atom