PT-2026-21839 · Unknown · Filebrowser Quantum

Byteafterlife · Published 2026-02-25 · Updated 2026-03-18 · CVE-2026-27611

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum versions prior to 1.1.3-stable FileBrowser Quantum versions prior to 1.2.6-beta

Description FileBrowser Quantum is a self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, a flaw existed where password-protected file shares could be bypassed, allowing unauthorized download access. The issue stemmed from the API returning a direct download link within the share details, accessible with only the share link, circumventing the password requirement. The vulnerable API endpoint provides access to the file without authentication. The share link is the vulnerable parameter.

Recommendations Update to FileBrowser Quantum version 1.1.3-stable or later. Update to FileBrowser Quantum version 1.2.6-beta or later.

Exploit

Fix

Information Disclosure

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-200

CWE-602

CWE-287

CWE-288

Related Identifiers

CVE-2026-27611

GHSA-8VRH-3PM2-V4V6

GO-2026-4546

SUSE-SU-2026:0757-1

Affected Products

Filebrowser Quantum

References · 122

• 🔥 https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27611.json · Exploit
• https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-27611 · Security Note
• https://osv.dev/vulnerability/GHSA-8vrh-3pm2-v4v6 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4546 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27611 · Vendor Advisory
• https://github.com/gtsteffaniak/filebrowser · Note
• https://github.com/gtsteffaniak/filebrowser/commit/a8c9b9419ec530568991a2f72cec4ed263f99e3c · Note
• https://suse.com/security/cve/CVE-2026-27611 · Note
• https://suse.com/security/cve/CVE-2026-24845 · Note
• https://suse.com/security/cve/CVE-2026-25934 · Note
• https://suse.com/security/cve/CVE-2026-25518 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note