HIGHGo
GHSA-3jmg-p96m-m328· CVE-2026-46410, GO-2026-5089FileBrowser Quantum: unauthenticated user share share info
Modified: 6/25/2026
package
Go/github.com/gtsteffaniak/filebrowser
pkg:go/github.com/gtsteffaniak/filebrowser
CRITICAL9.1Go
GHSA-fwj3-42wh-8673· CVE-2026-44542, GO-2026-5383FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion
Modified: 6/25/2026
MEDIUM5.4Go
GHSA-mmpx-jh39-wrv6· GO-2026-5511FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)
Modified: 6/25/2026
MEDIUM6.5Go
GHSA-r4v7-6wcg-ghj5· GO-2026-5776FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks
Modified: 6/25/2026
HIGH8.9Go
GHSA-r633-fcgp-m532· CVE-2026-30934, GO-2026-4660FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
Modified: 3/24/2026
—Go
GO-2026-4660· CVE-2026-30934, GHSA-r633-fcgp-m532FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) in github.com/gtsteffaniak/filebrowser
Modified: 3/23/2026
—Go
GO-2026-5089· CVE-2026-46410, GHSA-3jmg-p96m-m328FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser
Modified: 6/25/2026
—Go
GO-2026-5383· CVE-2026-44542, GHSA-fwj3-42wh-8673FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser
Modified: 6/25/2026
—Go
GO-2026-5511· GHSA-mmpx-jh39-wrv6FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) in github.com/gtsteffaniak/filebrowser
Modified: 6/25/2026
—Go
GO-2026-5776· GHSA-r4v7-6wcg-ghj5FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks in github.com/gtsteffaniak/filebrowser
Modified: 6/25/2026