FI
Product
filebrowser
8
CVEs
0
On KEV
9.3
Max CVSS
1
New 30D
Severity mix
Critical 2High 4Medium 2Low 0
Watch
Add filebrowser to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-48777 | 9.3 | Jun 16 | FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory Affected: < 1.3.3-stable; >= 1.4.0-beta, < 1.4.2-beta |
| CVE-2026-44542 | 9.1 | May 14 | FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion Affected: < 1.3.1-stable; < 1.3.9-beta |
| CVE-2026-46410 | 8.7 | Jul 20 | FileBrowser Quantum: unauthenticated user share share info Affected: < 1.3.2-stable; < 1.4.1-beta |
| CVE-2026-116682 New | 8.6 | Oct 27 | FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory Affected: < 1.5.2-stable; >= 2.0.0-beta, < 2.0.1-beta |
| CVE-2026-54910 | 7.7 | Jul 20 | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files Affected: < 1.4.3-beta |
| CVE-2026-30933 | 7.5 | Mar 10 | FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info Affected: >= 1.3.0-beta, < 1.3.1-beta; >= 1.2.6-beta, < 1.2.2-stable; = 1.1.3-stable |
| CVE-2026-30934 | 5.4 | Mar 10 | FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) Affected: >= 1.3.0-beta, < 1.3.1-beta; < 1.2.2-stable |
| CVE-2026-54685 | 5.3 | Jul 20 | FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel Affected: < 1.3.2-beta |
Showing 8