CVE-2026-30933 FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info
Attackers can bypass password protection on shares to obtain tokenized download URLs, exposing file access tokens.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-30933?
CVE-2026-30933 is a high-severity vulnerability in gtsteffaniak filebrowser, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
Which versions are affected by CVE-2026-30933?
3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser/backend. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gtsteffaniak/filebrowser/backend Go | All versions | 0.0.0-20260307130210-09713b32a5f6 |
github.com/gtsteffaniak/filebrowser/backend Go | All versions | 0.0.0-20260307130210-09713b32a5f6 |
github.com/gtsteffaniak/filebrowser/backend Go | All versions | 0.0.0-20260307130210-09713b32a5f6 |
Products include Filebrowser Filebrowser.
How do I fix CVE-2026-30933?
Upgrade github.com/gtsteffaniak/filebrowser/backend to 0.0.0-20260307130210-09713b32a5f6 or later.
Is CVE-2026-30933 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-30933 exists.
Other vulnerabilities in gtsteffaniak filebrowser
- CVE-2026-32760 File Browser Self Registration Grants Any User Admin Access When Default Permissions Include Admin
- CVE-2026-29188 File Browser: TUS Delete Endpoint Bypasses Delete Permission Check
- CVE-2023-39612 Cross-site scripting in n/a
- CVE-2026-30934 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
- CVE-2021-46398 Cross-Site Request Forgery in Filebrowser
Sources
Also known as GHSA-525j-95gf-766f, GO-2026-4659.