CVE-2026-30933: filebrowser
CVSS: 7.5v3.1HighAnalyzed
AliasesGHSA-525j-95gf-766fGO-2026-4659
Published 10-03-2026Last modified 10-03-2026
Vulnerability summary
CVE-2026-30933 is a high (CVSS 7.5) vulnerability in filebrowser. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (CVE.org)EPSS score
0.54%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 10-03-2026PublishedVulnerability first disclosed.
- 10-03-2026Last modifiedVulnerability information updated.
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.1Preferred score · OSV · Go (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:NSourcesSingle source
High 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NSourcesAll 3 agree
- OSV · GoEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
0.00 pp
From 0.54% on 21-09-2026
21-09-202621-10-2026
EPSS score0.54%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundFilebrowser
Maturity: poc
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-602Client-Side Enforcement of Server-Side SecurityThe product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
Affected systems
Filebrowser1 product
- filebrowser≤ 1.2.9 | 1.2.1:stable | 1.3.0:beta
Github.com/gtsteffaniak/filebrowser1 product
- backend< 0.0.0-20260307130210-09713b32a5f6
Gtsteffaniak1 product
- filebrowser≥ 1.3.0-beta, < 1.3.1-beta | ≥ 1.2.6-beta, < 1.2.2-stable | = 1.1.3-stable
3 vendors · 3 products
References
5 links- github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-525j-95gf-766fX Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
