CVE-2026-27611
Medium
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.
SeverityMedium
CVSS6.5
Exploit probability—
ProductGtsteffaniak Filebrowser Quantum
PublishedFeb 25, 2026
First seenFeb 25, 2026
How to fix
Update
- gtsteffaniak filebrowser_quantum1.1.3, 1.2.6 or later
- github.com/gtsteffaniak/filebrowser/backend0.0.0-20260221163904-dbcfba993b85 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gtsteffaniak filebrowser_quantum | v < 1.1.3, 1.2.0 ≤ v < 1.2.6, 1.1.3 | 1.1.3, 1.2.6 |
| github.com/gtsteffaniak/filebrowser/backendGo | v < 0.0.0-20260221163904-dbcfba993b85 | 0.0.0-20260221163904-dbcfba993b85 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.