FileBrowser Quantum Vulnerability in Self-Hosted File Manager
CVE-2026-30933
7.5HIGH
What is CVE-2026-30933?
FileBrowser Quantum, a self-hosted web-based file management tool, has a significant vulnerability that affects password-protected shares. Specifically, earlier versions than 1.3.1-beta and 1.2.2-stable unintentionally disclose tokenized download URLs via the /public/api/share/info endpoint. This security flaw can potentially expose sensitive file links to unauthorized users, necessitating immediate remediation by upgrading to the latest stable versions.
Affected Version(s)
filebrowser >= 1.3.0-beta, < 1.3.1-beta < 1.3.0-beta, 1.3.1-beta
filebrowser >= 1.2.6-beta, < 1.2.2-stable < 1.2.6-beta, 1.2.2-stable
filebrowser = 1.1.3-stable = 1.1.3-stable