# github.com/gtsteffaniak/filebrowser/backend (Go) vulnerabilities

7 known vulnerabilities (1 critical, 5 high, 1 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/gtsteffaniak/filebrowser/backend

## Advisories (7)

### [CVE-2026-116682](https://cve.now/CVE-2026-116682): FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

- Severity: High 8.6
- Published: Oct 27, 2026
- Affected: fixed in 0.0.0-20260814233832-4126edeb07a0.

### [CVE-2026-54910](https://cve.now/CVE-2026-54910): FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

- Severity: High 7.7
- Published: Jul 20, 2026
- Affected: fixed in 0.0.0-20260608182036-f3f4bbe80cb5.

### [CVE-2026-54685](https://cve.now/CVE-2026-54685): FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

- Severity: Medium 5.3
- Published: Jul 20, 2026
- Affected: fixed in 0.0.0-20260317230626-af08800667b8.

### [CVE-2026-46410](https://cve.now/CVE-2026-46410): FileBrowser Quantum: unauthenticated user share share info

- Severity: High 8.7
- Published: Jul 20, 2026
- Affected: fixed in 0.0.0-20260514154726-1802e1281135.

### [CVE-2026-48777](https://cve.now/CVE-2026-48777): FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

- Severity: Critical 9.3
- Published: Jun 16, 2026
- Affected: fixed in 0.0.0-20260518193514-28e9b81e438e.

### [CVE-2026-30933](https://cve.now/CVE-2026-30933): FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

- Severity: High 7.5
- Published: Mar 10, 2026
- Affected: fixed in 0.0.0-20260307130210-09713b32a5f6.

### [CVE-2026-27611](https://cve.now/CVE-2026-27611): FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

- Severity: High 7.1
- Published: Feb 25, 2026
- Affected: fixed in 0.0.0-20260221163904-dbcfba993b85.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/gtsteffaniak/filebrowser/backend
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.