Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/gtsteffaniak/filebrowser

3 known vulnerabilities (1 critical, 2 high), with the versions each affects and the releases that fix them.

Latest release
v0.3.4 (Dec 26, 2024): affected by CVE-2026-46410
Newest unaffected release
Every release is affected by at least one advisory
Advisories
3 · 1 critical, 2 high
Releases
173 since v0.1.4 (May 5, 2024)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-46410
    Affects v0.1.4 to v1.2.1-stable (v1.2.2-beta is outside it)
  • CVE-2026-44542
    No published release is affected
    No published release is affected
  • CVE-2026-30934
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • FileBrowser Quantum: unauthenticated user share share info

    Affected: fixed in 1.2.1-stable.0.20260514154726-1802e1281135.

    No fix released. The advisory names 1.2.1-stable.0.20260514154726-1802e1281135 as the fix, which the registry doesn't have yet. The latest release, v0.3.4, is still affected.

  • CVE-2026-44542Critical 9.1

    FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion

    Affected: fixed in 0.0.0-20260501183844-112740bdd41d.

    Fixed in v0.1.4 (released May 5, 2024, 739 days before disclosure, the advisory names 0.0.0-20260501183844-112740bdd41d, which was never published).

    The latest release, v0.3.4, is not affected.

  • FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

    Affected: fixed in 0.0.0-20260307130210-09713b32a5f6.

    Fixed in v0.1.4 (released May 5, 2024, 674 days before disclosure, the advisory names 0.0.0-20260307130210-09713b32a5f6, which was never published).

    The latest release, v0.3.4, is not affected.