Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-30933

FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GitHub_M

Description

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

gtsteffaniak filebrowser

  • >= 1.3.0-beta, < 1.3.1-betaaffected
  • >= 1.2.6-beta, < 1.2.2-stableaffected
  • = 1.1.3-stableaffected

References