Vulnerabilities

TI-2026-81497 CVE-2026-116682 · GHSA-mgqf-5mf5-prfj

Symlink following in FileBrowser Quantum exposes out-of-scope files

HIGH 76

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00536 Published 2026-10-27 Fixed in 1.5.2-stable, 2.0.1-beta +1 CWE-22

TI-2026-39682 CVE-2026-54910 · GHSA-vvp7-h4fj-m28w

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

HIGH 67

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00377 Published 2026-07-20 Fixed in 1.4.3-beta, 0.0.0-20260608182036-f3f4bbe80cb5 CWE-22

TI-2026-39506 CVE-2026-54685 · GHSA-7789-65hx-f26w

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

MEDIUM 63

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00338 Published 2026-07-20 Fixed in 1.3.2-beta, 0.0.0-20260317230626-af08800667b8 CWE-208

TI-2026-34124 CVE-2026-46410 · GHSA-3jmg-p96m-m328

FileBrowser Quantum: unauthenticated user share share info

MEDIUM 44

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00445 Published 2026-07-20 Fixed in 1.3.2-stable, 1.4.1-beta +2 CWE-200

TI-2026-36047 CVE-2026-48777 · GHSA-qqqm-5547-774x

FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

HIGH 81

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.0055 Published 2026-06-16 Fixed in 1.3.3-stable, 1.4.2-beta +1 CWE-22

TI-2026-32454 CVE-2026-44542 · GHSA-fwj3-42wh-8673

FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion

HIGH 78

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00523 Published 2026-05-14 Fixed in 1.3.1-stable, 1.3.9-beta +1 CWE-22

TI-2026-23759 CVE-2026-30934 · GHSA-r633-fcgp-m532

FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

HIGH 74

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00413 Published 2026-03-10 Fixed in 1.3.1-beta, 1.2.2-stable +1 CWE-79

TI-2026-23758 CVE-2026-30933 · GHSA-525j-95gf-766f

FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

HIGH 72

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00632 Published 2026-03-10 Fixed in 1.3.1-beta, 1.2.2-stable +1 CWE-200

TI-2026-21997 CVE-2026-27611 · GHSA-8vrh-3pm2-v4v6

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

HIGH 70

FileBrowser Quantum is a free, self-hosted, web-based file manager.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00366 Published 2026-02-25 Fixed in 1.1.3-stable, 1.2.6-beta +1 CWE-200

Vulnerabilities

Filters