CVE-2026-30934

Published: Mar 10, 2026Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

Affected (3)

Products: Filebrowser: Filebrowser

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Filebrowser Filebrowser	Up to 1.2.9
Filebrowser Filebrowser	Version 1.2.1 stable
Filebrowser Filebrowser	Version 1.3.0 beta

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable

Source: security-advisories@github.com

Release Notes

https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta

Source: security-advisories@github.com

Release Notes

https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r633-fcgp-m532

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.