GHSA-mmpx-jh39-wrv6 FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Not scored Published 7 May 2026

Attackers can execute arbitrary JavaScript in victims' browsers via malicious SVG files shared publicly, potentially stealing sessions.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-mmpx-jh39-wrv6?

GHSA-mmpx-jh39-wrv6 is a cross-site scripting vulnerability in github.com/gtsteffaniak/filebrowser, published on 7 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Summary

FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.

Verified on v1.3.0-stable.

Affected product

Product: FileBrowser Quantum (gtsteffaniak/filebrowser)
Verified version: v1.3.0-stable
Docker image: gtstef/filebrowser:latest
Affected endpoint: GET /public/api/resources/download?hash=HASH&inline=true
CWE: CWE-79 — Cross-site Scripting (Stored)

Impact

Stored XSS — Malicious SVG persists and executes for every visitor to the share link
No authentication required to trigger — Public share links are accessible to anyone
Session hijacking — If authenticated users click the link, their session can be stolen
Phishing — Attacker can redirect or overlay fake login forms

Reproduction

Upload SVG file:

&lt;svg xmlns=&#34;http://www.w3.org/2000/svg&#34;&gt;
  &lt;script&gt;alert(document.domain)&lt;/script&gt;
&lt;/svg&gt;

Create public share for the file
Access the share link with ?inline=true
JavaScript executes in browser

Root cause

The inline download endpoint returns SVG files with:

Content-Type: image/svg+xml
Content-Disposition: inline; filename=&#34;xss.svg&#34;
X-Content-Type-Options: nosniff

But no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:

Content-Security-Policy: script-src &#39;none&#39;

Suggested fix

Add CSP header on inline file downloads:

w.Header().Set(&#34;Content-Security-Policy&#34;, &#34;script-src &#39;none&#39;&#34;)

This matches the upstream filebrowser/filebrowser implementation.

Which versions are affected by GHSA-mmpx-jh39-wrv6?

3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser.

Package	Affected	Fixed in
`github.com/gtsteffaniak/filebrowser` Go	All versions	`0.0.0-20260501184955-6bfc3974192e`
`github.com/gtsteffaniak/filebrowser` Go	All versions	`0.0.0-20260501184955-6bfc3974192e`
`github.com/gtsteffaniak/filebrowser` Go	All versions	`0.0.0-20260501184955-6bfc3974192e`

How do I fix GHSA-mmpx-jh39-wrv6?

Upgrade github.com/gtsteffaniak/filebrowser to 0.0.0-20260501184955-6bfc3974192e or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-mmpx-jh39-wrv6 being exploited?

There is no known exploitation of GHSA-mmpx-jh39-wrv6 in the wild and no public exploit code.

Sources

Also known as GO-2026-5511.