Skip to content
OpenAdvisories

Package · Go

github.com/gtsteffaniak/filebrowser

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    GHSA-r4v7-6wcg-ghj5

    FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks

    ### Summary The `/api/auth/login` endpoint does not implement rate limiting, account lockout, or progressive backoff for repeated authentication failures. As a result, an attacker can perform unlimited login attempts against the endpoint. When combined with t…

    github.com/gtsteffaniak/filebrowser Go
  • Medium 5.4
    GHSA-mmpx-jh39-wrv6

    FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

    ## Summary FileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. ## Affected product - **Product:** FileBro…

    github.com/gtsteffaniak/filebrowser Go