Skip to content
OpenAdvisories

Package · Go

github.com/gtsteffaniak/filebrowser/backend

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.6
    CVE-2026-116682

    FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remai…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go
  • High 7.7
    CVE-2026-54910

    FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go
  • Medium 5.3
    CVE-2026-54685

    FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` respon…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go
  • High 8.7
    CVE-2026-46410

    FileBrowser Quantum: unauthenticated user share share info

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available.

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend github.com/gtsteffaniak/filebrowser Go
  • Critical 9.3
    CVE-2026-48777

    FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and to…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go
  • High 7.5
    CVE-2026-30933

    FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnera…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go
  • High 7.1
    CVE-2026-27611

    FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because th…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go