{"id":"CVE-2026-34529","aliases":["GHSA-5vpr-4fgw-f69h","GO-2026-5156"],"url":"https://o3.security/vulnerability/CVE-2026-34529","summary":"File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file","details":"### Summary\n\nThe EPUB preview function in File Browser is vulnerable to Stored Cross-site Scripting (XSS). JavaScript embedded in a crafted EPUB file executes in the victim's browser when they preview the file.\n\n### Details\n\n`frontend/src/views/files/Preview.vue` passes `allowScriptedContent: true` to the `vue-reader` (epub.js) component:\n```js\n// frontend/src/views/files/Preview.vue (Line 87)\n:epubOptions=\"{\n allowPopups: true,\n allowScriptedContent: true,\n}\"\n```\nepub.js renders EPUB content inside a sandboxed