https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-35607.htmlhttps://patchthecve.com/cve/CVE-2026-35607.htmlWed, 17 Jun 2026 10:40:51 +0000HIGH 8.1: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the fix in commit b6a4fb1 ("self-registered users don't get execute perms") stripped Execute permission and Commands from users created via the sihttps://patchthecve.com/cve/CVE-2026-35606.htmlhttps://patchthecve.com/cve/CVE-2026-35606.htmlWed, 17 Jun 2026 10:40:51 +0000HIGH 7.5: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the resourceGetHandler in http/resource.go returns full text file content without checking the Perm.Download permission flag. All three other conthttps://patchthecve.com/cve/CVE-2026-35605.htmlhttps://patchthecve.com/cve/CVE-2026-35605.htmlWed, 17 Jun 2026 10:40:51 +0000HIGH 7.5: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, the Matches() function in rules/rules.go uses strings.HasPrefix() without a trailing directory separator when matching paths against access rules.https://patchthecve.com/cve/CVE-2026-35604.htmlhttps://patchthecve.com/cve/CVE-2026-35604.htmlWed, 17 Jun 2026 10:40:51 +0000HIGH 8.1: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.1, when an admin revokes a user's Share and Download permissions, existing share links created by that user remain fully accessible to unauthenticatehttps://patchthecve.com/cve/CVE-2026-35585.htmlhttps://patchthecve.com/cve/CVE-2026-35585.htmlWed, 17 Jun 2026 10:40:49 +0000HIGH 7.2: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — https://patchthecve.com/cve/CVE-2026-34530.htmlhttps://patchthecve.com/cve/CVE-2026-34530.htmlWed, 17 Jun 2026 10:39:10 +0000MEDIUM 6.9: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the SPA index page in File Browser is vulnerable to Stored Cross-Site Scripting (XSS) via admin-controlled branding fields. An admin who shttps://patchthecve.com/cve/CVE-2026-34529.htmlhttps://patchthecve.com/cve/CVE-2026-34529.htmlWed, 17 Jun 2026 10:39:10 +0000HIGH 7.6: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the EPUB preview function in File Browser is vulnerable to Stored Cross-Site Scripting (XSS). JavaScript embedded in a crafted EPUB file ehttps://patchthecve.com/cve/CVE-2026-34528.htmlhttps://patchthecve.com/cve/CVE-2026-34528.htmlWed, 17 Jun 2026 10:39:10 +0000HIGH 8.1: File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips only Admin. The Execut