{"answers":{"affected":"3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser.","exploited":"There is no known exploitation of GHSA-mmpx-jh39-wrv6 in the wild and no public exploit code.","fix":"Upgrade github.com/gtsteffaniak/filebrowser to 0.0.0-20260501184955-6bfc3974192e or later.","what":"GHSA-mmpx-jh39-wrv6 is a cross-site scripting vulnerability in github.com/gtsteffaniak/filebrowser, published on 7 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for GHSA-mmpx-jh39-wrv6 and fix it if it is affected.\n\nWhat it is: GHSA-mmpx-jh39-wrv6 is a cross-site scripting vulnerability in github.com/gtsteffaniak/filebrowser, published on 7 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of GHSA-mmpx-jh39-wrv6 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260501184955-6bfc3974192e\n- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260501184955-6bfc3974192e\n- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260501184955-6bfc3974192e\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/ (Markdown: https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/index.md)","id":"GHSA-mmpx-jh39-wrv6","markdown":"https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/index.md","name":"GHSA-mmpx-jh39-wrv6","record":{"aliases":["GO-2026-5511"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["account_takeover","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"FileBrowser Quantum","requires_auth":"low_privilege","summary":"Attackers can execute arbitrary JavaScript in victims' browsers via malicious SVG files shared publicly, potentially stealing sessions.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\nFileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.\n\nVerified on v1.3.0-stable.\n\n## Affected product\n\n- **Product:** FileBrowser Quantum (`gtsteffaniak/filebrowser`)\n- **Verified version:** v1.3.0-stable\n- **Docker image:** gtstef/filebrowser:latest\n- **Affected endpoint:** `GET /public/api/resources/download?hash=HASH\u0026inline=true`\n- **CWE:** CWE-79 — Cross-site Scripting (Stored)\n\n## Impact\n\n- **Stored XSS** — Malicious SVG persists and executes for every visitor to the share link\n- **No authentication required to trigger** — Public share links are accessible to anyone\n- **Session hijacking** — If authenticated users click the link, their session can be stolen\n- **Phishing** — Attacker can redirect or overlay fake login forms\n\n## Reproduction\n\n1. Login as any user with upload permission\n2. Upload SVG file:\n   ```xml\n   \u003csvg xmlns=\"http://www.w3.org/2000/svg\"\u003e\n     \u003cscript\u003ealert(document.domain)\u003c/script\u003e\n   \u003c/svg\u003e\n   ```\n3. Create public share for the file\n4. Access the share link with `?inline=true`\n5. JavaScript executes in browser\n\n## Root cause\n\nThe inline download endpoint returns SVG files with:\n```\nContent-Type: image/svg+xml\nContent-Disposition: inline; filename=\"xss.svg\"\nX-Content-Type-Options: nosniff\n```\n\nBut no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:\n```\nContent-Security-Policy: script-src 'none'\n```\n\n## Suggested fix\n\nAdd CSP header on inline file downloads:\n\n```go\nw.Header().Set(\"Content-Security-Policy\", \"script-src 'none'\")\n```\n\nThis matches the upstream filebrowser/filebrowser implementation.","ecosystems":["Go"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)","id":"GHSA-mmpx-jh39-wrv6","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"xss","year":"2026"},"n_packages":3,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["0.0.0-20260501184955-6bfc3974192e"],"introduced":["0"],"last_affected":[],"package":"github.com/gtsteffaniak/filebrowser","purl":null,"source":"GHSA-mmpx-jh39-wrv6"},{"ecosystem":"Go","fixed":["0.0.0-20260501184955-6bfc3974192e"],"introduced":["0"],"last_affected":[],"package":"github.com/gtsteffaniak/filebrowser","purl":"pkg:golang/github.com/gtsteffaniak/filebrowser","source":"GHSA-mmpx-jh39-wrv6"},{"ecosystem":"Go","fixed":["0.0.0-20260501184955-6bfc3974192e"],"introduced":["0"],"last_affected":[],"package":"github.com/gtsteffaniak/filebrowser","purl":"pkg:golang/github.com/gtsteffaniak/filebrowser","source":"GO-2026-5511"}],"products":null,"published":"2026-05-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can execute arbitrary JavaScript in victims' browsers via malicious SVG files shared publicly, potentially stealing sessions.","url":"https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/"}