HIGHGo
GHSA-3jmg-p96m-m328· CVE-2026-46410, GO-2026-5089FileBrowser Quantum: unauthenticated user share share info
Modified: 6/25/2026
package
Go/github.com/gtsteffaniak/filebrowser/backend
pkg:go/github.com/gtsteffaniak/filebrowser/backend
HIGH7.5Go
GHSA-525j-95gf-766f· CVE-2026-30933, GO-2026-4659FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info
Modified: 5/5/2026
MEDIUM5.3Go
GHSA-7789-65hx-f26w· CVE-2026-54685, GO-2026-4820FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
Modified: 7/8/2026
MEDIUM6.5Go
GHSA-8vrh-3pm2-v4v6· CVE-2026-27611, GO-2026-4546FileBrowser Quantum: Password Protection Not Enforced on Shared File Links
Modified: 5/5/2026
CRITICALGo
GHSA-qqqm-5547-774x· CVE-2026-48777, GO-2026-5591FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory
Modified: 6/25/2026
HIGH7.7Go
GHSA-vvp7-h4fj-m28w· CVE-2026-54910, GO-2026-6164FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
Modified: 8/18/2026
—Go
GO-2026-4546· CVE-2026-27611, GHSA-8vrh-3pm2-v4v6FileBrowser Quantum: Password Protection Not Enforced on Shared File Links in github.com/gtsteffaniak/filebrowser/backend
Modified: 2/25/2026
—Go
GO-2026-4659· CVE-2026-30933, GHSA-525j-95gf-766fFileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info in github.com/gtsteffaniak/filebrowser/backend
Modified: 3/23/2026
—Go
GO-2026-4820· CVE-2026-54685, GHSA-7789-65hx-f26wFileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel in github.com/gtsteffaniak/filebrowser/backend
Modified: 7/8/2026
—Go
GO-2026-5089· CVE-2026-46410, GHSA-3jmg-p96m-m328FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser
Modified: 6/25/2026
—Go
GO-2026-5591· CVE-2026-48777, GHSA-qqqm-5547-774xFileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory in github.com/gtsteffaniak/filebrowser/backend
Modified: 6/25/2026
—Go
GO-2026-6164· CVE-2026-54910, GHSA-vvp7-h4fj-m28wFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend
Modified: 8/18/2026