# GHSA-mmpx-jh39-wrv6: FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

> Attackers can execute arbitrary JavaScript in victims' browsers via malicious SVG files shared publicly, potentially stealing sessions.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 7 May 2026
- **Also known as:** GO-2026-5511

## What is GHSA-mmpx-jh39-wrv6?

GHSA-mmpx-jh39-wrv6 is a cross-site scripting vulnerability in github.com/gtsteffaniak/filebrowser, published on 7 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

### Official description

## Summary

FileBrowser Quantum serves inline SVG files without a `Content-Security-Policy` header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.

Verified on v1.3.0-stable.

## Affected product

- **Product:** FileBrowser Quantum (`gtsteffaniak/filebrowser`)
- **Verified version:** v1.3.0-stable
- **Docker image:** gtstef/filebrowser:latest
- **Affected endpoint:** `GET /public/api/resources/download?hash=HASH&inline=true`
- **CWE:** CWE-79 — Cross-site Scripting (Stored)

## Impact

- **Stored XSS** — Malicious SVG persists and executes for every visitor to the share link
- **No authentication required to trigger** — Public share links are accessible to anyone
- **Session hijacking** — If authenticated users click the link, their session can be stolen
- **Phishing** — Attacker can redirect or overlay fake login forms

## Reproduction

1. Login as any user with upload permission
2. Upload SVG file:
   ```xml
   <svg xmlns="http://www.w3.org/2000/svg">
     <script>alert(document.domain)</script>
   </svg>
   ```
3. Create public share for the file
4. Access the share link with `?inline=true`
5. JavaScript executes in browser

## Root cause

The inline download endpoint returns SVG files with:
```
Content-Type: image/svg+xml
Content-Disposition: inline; filename="xss.svg"
X-Content-Type-Options: nosniff
```

But no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:
```
Content-Security-Policy: script-src 'none'
```

## Suggested fix

Add CSP header on inline file downloads:

```go
w.Header().Set("Content-Security-Policy", "script-src 'none'")
```

This matches the upstream filebrowser/filebrowser implementation.

## Which versions are affected by GHSA-mmpx-jh39-wrv6?

3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `github.com/gtsteffaniak/filebrowser` | Go | All versions | 0.0.0-20260501184955-6bfc3974192e |
| `github.com/gtsteffaniak/filebrowser` | Go | All versions | 0.0.0-20260501184955-6bfc3974192e |
| `github.com/gtsteffaniak/filebrowser` | Go | All versions | 0.0.0-20260501184955-6bfc3974192e |

## How do I fix GHSA-mmpx-jh39-wrv6?

Upgrade github.com/gtsteffaniak/filebrowser to 0.0.0-20260501184955-6bfc3974192e or later.

## Is GHSA-mmpx-jh39-wrv6 being exploited?

There is no known exploitation of GHSA-mmpx-jh39-wrv6 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-mmpx-jh39-wrv6 and fix it if it is affected.

What it is: GHSA-mmpx-jh39-wrv6 is a cross-site scripting vulnerability in github.com/gtsteffaniak/filebrowser, published on 7 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-mmpx-jh39-wrv6 in the wild and no public exploit code.

Affected packages and fixed versions:
- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260501184955-6bfc3974192e
- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260501184955-6bfc3974192e
- github.com/gtsteffaniak/filebrowser (Go): affected all versions; fixed in 0.0.0-20260501184955-6bfc3974192e

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/ (Markdown: https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-mmpx-jh39-wrv6

---
From sbomify Insights: https://insights.sbomify.com/GHSA-mmpx-jh39-wrv6/
Summaries are generated and may contain mistakes; the official description above is the record.