CVE-2026-30933

HIGH7.5

FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

Published Mar 10, 2026

Modified 6 days ago

Details

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

References

WEB

https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable

WEB

https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta

WEB

https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-525j-95gf-766f

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-30933

CVSS Analysis

CVSS v3.1

7.5