https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 12:37:49 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275261 EUVD-2026-275261 https://cve.radiocsirt.org/vuln/euvd-2026-275261 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30933 <p>FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.</p> <p>FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30933 https://cve.radiocsirt.org/vuln/ghsa-525j-95gf-766f <p><strong>Affected:</strong> Go: github.com/gtsteffaniak/filebrowser/backend</p> <p>### Summary The remediation for CVE-2026-27611 appears incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info in docker image gtstef/filebrowser:1.3.1-webdav-2.</p> <p>### Details The issue stems from two flaws: 1. Tokenized download URLs are written into the persistent share model ``` backend/http/share.go convertToFrontendShareResponse(line 63) s.DownloadURL = getShareURL(r, s.Hash, true, s.Token) ``` 2. The public endpoint: ``` GET /public/api/share/info returns shareLink.CommonShare without clearing DownloadURL. ```</p> <p>Since Token is set for password-protected shares, and getShareURL(..., true, token) embeds it as a query parameter, the public API discloses a valid bearer download capability.</p> <p>The previous patch removed token generation in one handler but did not address the persisted DownloadURL values/Public reflection of existing DownloadURL</p> <p>### PoC 1. Create a password protected share as an authenticated user</p> <p>2. Copy the public share URL (the clipboard WITHOUT an arrow) `http://yourdomain/public/share/yoursharedhash` Example: `http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw`</p> <p>3. Query the public share endpoint via curl request: `curl &#39;http://yourdomain/public/api/share/info?hash=(your-share-hash)&#39; -H &#39;Accept: */*&#39; ` Example: `curl &#39;http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw&#39; -H &#39;Accept: */*&#39; ` Response includes: ``` { &#34;shareTheme&#34;: &#34;defa…</p> <p><strong>Affected:</strong> Go: github.com/gtsteffaniak/filebrowser/backend</p> <p>### Summary The remediation for CVE-2026-27611 appears incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info in docker image gtstef/filebrowser:1.3.1-webdav-2.</p> <p>### Details The issue stems from two flaws: 1. Tokenized download URLs are written into the persistent share model ``` backend/http/share.go convertToFrontendShareResponse(line 63) s.DownloadURL = getShareURL(r, s.Hash, true, s.Token) ``` 2. The public endpoint: ``` GET /public/api/share/info returns shareLink.CommonShare without clearing DownloadURL. ```</p> <p>Since Token is set for password-protected shares, and getShareURL(..., true, token) embeds it as a query parameter, the public API discloses a valid bearer download capability.</p> <p>The previous patch removed token generation in one handler but did not address the persisted DownloadURL values/Public reflection of existing DownloadURL</p> <p>### PoC 1. Create a password protected share as an authenticated user</p> <p>2. Copy the public share URL (the clipboard WITHOUT an arrow) `http://yourdomain/public/share/yoursharedhash` Example: `http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw`</p> <p>3. Query the public share endpoint via curl request: `curl &#39;http://yourdomain/public/api/share/info?hash=(your-share-hash)&#39; -H &#39;Accept: */*&#39; ` Example: `curl &#39;http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw&#39; -H &#39;Accept: */*&#39; ` Response includes: ``` { &#34;shareTheme&#34;: &#34;defa…</p> https://cve.radiocsirt.org/vuln/ghsa-525j-95gf-766f