TI-2026-21997 Aliases CVE-2026-27611 GHSA-8vrh-3pm2-v4v6

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

HIGH 70CWE-200Published 2026-02-25 · Updated 2026-02-27

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure, Security bypass
Confidentiality · integrity · availability: High · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-200 and CWE-287.

Summary

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00366 30th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed filebrowser (gtsteffaniak): 1.1.3-stable, 1.2.6-betagithub.com/gtsteffaniak/filebrowser/backend (Go): 0.0.0-20260221163904-dbcfba993b85

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
gtsteffaniak	filebrowser	before 1.1.3-stable; 1.2.0-beta to before 1.2.6-beta	1.1.3-stable, 1.2.6-beta	Patch available	CNA
—	github.com/gtsteffaniak/filebrowser/backend (Go)	before 0.0.0-20260221163904-dbcfba993b85	0.0.0-20260221163904-dbcfba993b85	Patch available	GHSA-8vrh-3pm2-v4v6

filebrowser Vendorgtsteffaniak Affected before 1.1.3-stable; 1.2.0-beta to before 1.2.6-beta Fixed in 1.1.3-stable, 1.2.6-beta Patch available CNA
github.com/gtsteffaniak/filebrowser/backend (Go) Vendor— Affected before 0.0.0-20260221163904-dbcfba993b85 Fixed in 0.0.0-20260221163904-dbcfba993b85 Patch available GHSA-8vrh-3pm2-v4v6

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:gtsteffaniak:filebrowser_quantum::::::::	before 1.1.3; 1.2.0 to before 1.2.6	Vulnerable	gtsteffaniak
cpe:2.3:a:gtsteffaniak:filebrowser_quantum:1.1.3:beta::::::	1.1.3 beta	Vulnerable	gtsteffaniak

cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:*:*:*:*:*:*:* Versions before 1.1.3; 1.2.0 to before 1.2.6 Vulnerable ·gtsteffaniak
cpe:2.3:a:gtsteffaniak:filebrowser_quantum:1.1.3:beta:*:*:*:*:*:* Versions 1.1.3 beta Vulnerable ·gtsteffaniak

Remediation

Fix · CNA filebrowser (gtsteffaniak) Fixed in 1.1.3-stable, 1.2.6-beta
Fix · GHSA-8vrh-3pm2-v4v6 github.com/gtsteffaniak/filebrowser/backend (Go) Fixed in 0.0.0-20260221163904-dbcfba993b85 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27611
2026-10-03 Alias added: GHSA-8vrh-3pm2-v4v6

References

Other 3

TI-2026-32454 FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences