# File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file File Browser's EPUB preview enables allowScriptedContent, so a crafted EPUB's JavaScript runs in a sandbox with allow-scripts+allow-same-origin and steals the parent's JWT. - Payout: Research - Severity: high - Program: File Browser - Found by: tomasvanagas - Disclosed: 2026-03-31 - CVE: CVE-2026-34529 - Write-up quality: 7/10 - Original: https://github.com/advisories/GHSA-5vpr-4fgw-f69h - Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-5vpr-4fgw-f69h - Tags: area:web domain:web impact:ato impact:data-leak impact:privesc kind:research platform:ghsa sev:high tech:nodejs technique:source-review vuln:xss **Target:** EPUB preview (vue-reader/epub.js iframe) in File Browser web UI **Root cause:** Preview.vue passes allowScriptedContent: true (and allowPopups) to epub.js, which renders EPUB content in an iframe sandboxed with both allow-scripts and allow-same-origin, defeating the sandbox so scripts reach the parent frame's DOM and localStorage. **Steps:** 1. Deploy filebrowser/filebrowser:v2.62.1 via docker compose on port 80 2. Authenticate: `POST /api/login` with `{"username":...,"password":...}` returns JWT 3. Build EPUB 3 zip: mimetype, META-INF/container.xml, OEBPS/content.opf, nav.xhtml, chapter1.xhtml containing ` """ ```