Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Go github.com/gtsteffaniak/filebrowser < 0.0.0-20260522161427-fa5abc8c67f3a
Fixed in
0.0.0-20260522161427-fa5abc8c67f3a· Vendor fix available
Issue
The /api/auth/login endpoint does not implement rate limiting, account lockout, or progressive backoff for repeated authentication failures. As a result, an attacker can perform unlimited login attempts against the endpoint. When combined with the username enumeration timing vulnerability, valid accounts can be identified and then brute-forced without restriction. The risk is further increased by a weak default password policy that only enforces a minimum length of five characters. Details The authentication endpoint /api/auth/login does not enforce any form of rate limiting, account lockout, or progressive backoff for repeated failed login attempts. Testing confirmed that the endpoint accepts an unlimited number of authentication attempts from the same client without delay or restriction. This allows attackers to repeatedly attempt password guesses against valid usernames. Secure authentication systems typically enforce request throttling, temporary account lockout, or…
Recommended action: Upgrade to 0.0.0-20260522161427-fa5abc8c67f3a (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gtsteffaniak/filebrowser < 1.2.1-stable.0.20260514154726-1802e1281135
Fixed in
1.2.1-stable.0.20260514154726-1802e1281135· Vendor fix available
Issue
Impact Some sensitive info -- such as source and path can get exposed. Patches Update to the latest version Workarounds no
Recommended action: Upgrade to 1.2.1-stable.0.20260514154726-1802e1281135 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gtsteffaniak/filebrowser < 0.0.0-20260501184955-6bfc3974192e
Fixed in
0.0.0-20260501184955-6bfc3974192e· Vendor fix available
Issue
FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. Affected product - Product: FileBrowser Quantum (gtsteffaniak/filebrowser) - Verified version: v1.3.0-stable - Docker image: gtstef/filebrowser:latest - Affected endpoint: GET /public/api/resources/download?hash=HASH&inline=true - CWE: CWE-79 — Cross-site Scripting (Stored) Impact - Stored XSS — Malicious SVG persists and executes for every visitor to the share link - No authentication required to trigger — Public share links are accessible to anyone - Session hijacking — If authenticated users click the link, their session can be stolen - Phishing — Attacker can redirect or overlay fake login forms Reproduction 1. Login as any user with upload permission 2. Upload SVG file: 3. Create public share for the file 4. Access the share link with ?inline=true 5. JavaScript executes…
Recommended action: Upgrade to 0.0.0-20260501184955-6bfc3974192e (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gtsteffaniak/filebrowser < 0.0.0-20260501183844-112740bdd41d
Fixed in
0.0.0-20260501183844-112740bdd41d· Vendor fix available
Issue
Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. Affected Components Two distinct vulnerable code paths: 1. Stable versions (e.g., gtstef/filebrowser:stable) DELETE /public/api/resources?hash=<hash&path=../victim Root cause: middleware.go:111 Issue: path query parameter is joined before SanitizeUserPath() 2. Development / HEAD (e.g., commit eabdfd9) DELETE /public/api/resources/bulk?hash=<hash Body: [{"path":"../victim"}] Root cause: resource.go:274 Issue: item.Path is joined before SanitizeUserPath() Steps to reproduce (Stable Version) 1. Create a directory structure: 2. Create a public share: 3. Send request: Proof of Concept (HEAD / bulk…
Recommended action: Upgrade to 0.0.0-20260501183844-112740bdd41d (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/gtsteffaniak/filebrowser < 0.0.0-20260307130210-09713b32a5f6
Fixed in
0.0.0-20260307130210-09713b32a5f6· Vendor fix available
Issue
Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. Details The server renders public/index.html using text/template and injects user-controlled share fields (title/description/etc.) into HTML contexts. text/template does not perform HTML contextual escaping like html/template. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page. Relevant code paths: - backend/http/static.go (template rendering and share metadata assignment) - backend/http/httpRouter.go (template initialization) - frontend/public/index.html (insertion points for title/description and related fields) PoC 1. Login as a user with share creation permission. 2. Create a share (POST /api/share) with malicious…
Recommended action: Upgrade to 0.0.0-20260307130210-09713b32a5f6 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.