CVE-2026-30933 Details
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
A vulnerability in FileBrowser Quantum prior to versions 1.3.1-beta and 1.2.2-stable allows unauthorized access to password-protected shared files. The issue arises because tokenized download URLs are inadvertently exposed through the public API share info endpoint, bypassing password protections. This flaw is present in versions 1.3.0-beta and 1.2.1-stable.
Users can update to FileBrowser Quantum versions 1.3.1-beta or 1.2.2-stable, both of which include the necessary fix for this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable | [email protected] | Release Notes |
| https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta | [email protected] | Release Notes |
| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-525j-95gf-766f | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-306 | Missing Authentication for Critical Function | [email protected] |
| CWE-602 | Client-Side Enforcement of Server-Side Security | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| filebrowser filebrowser | <= 1.2.9 1.2.1 stable 1.3.0 beta |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 18, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |