FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

Affected: Go: github.com/gtsteffaniak/filebrowser/backend

### Summary The remediation for CVE-2026-27611 appears incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info in docker image gtstef/filebrowser:1.3.1-webdav-2.

### Details The issue stems from two flaws: 1. Tokenized download URLs are written into the persistent share model ``` backend/http/share.go convertToFrontendShareResponse(line 63) s.DownloadURL = getShareURL(r, s.Hash, true, s.Token) ``` 2. The public endpoint: ``` GET /public/api/share/info returns shareLink.CommonShare without clearing DownloadURL. ```

Since Token is set for password-protected shares, and getShareURL(..., true, token) embeds it as a query parameter, the public API discloses a valid bearer download capability.

The previous patch removed token generation in one handler but did not address the persisted DownloadURL values/Public reflection of existing DownloadURL

### PoC 1. Create a password protected share as an authenticated user

2. Copy the public share URL (the clipboard WITHOUT an arrow) `http://yourdomain/public/share/yoursharedhash` Example: `http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw`

3. Query the public share endpoint via curl request: `curl 'http://yourdomain/public/api/share/info?hash=(your-share-hash)' -H 'Accept: */*' ` Example: `curl 'http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw' -H 'Accept: */*' ` Response includes: ``` { "shareTheme": "defa…