Skip to content
OpenAdvisories

Product · gtsteffaniak

filebrowser

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2026-54685

    FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

    FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` respon…

    gtsteffaniak filebrowser github.com/gtsteffaniak/filebrowser/backend Go