https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 00:01:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-275260 EUVD-2026-275260 https://cve.radiocsirt.org/vuln/euvd-2026-275260 https://cve.radiocsirt.org/vuln/fkie_cve-2026-30934 <p>FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/&lt;hash&gt; without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.</p> <p>FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/&lt;hash&gt; without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-30934 https://cve.radiocsirt.org/vuln/ghsa-r633-fcgp-m532 <p><strong>Affected:</strong> Go: github.com/gtsteffaniak/filebrowser</p> <p>## Summary Stored XSS is possible via share metadata fields (e.g., `title`, `description`) that are rendered into HTML for `/public/share/&lt;hash&gt;` without context-aware escaping. The server uses `text/template` instead of `html/template`, allowing injected scripts to execute when victims visit the share URL.</p> <p>## Details The server renders `public/index.html` using `text/template` and injects user-controlled share fields (title/description/etc.) into HTML contexts. `text/template` does not perform HTML contextual escaping like `html/template`. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page.</p> <p>Relevant code paths: - `backend/http/static.go` (template rendering and share metadata assignment) - `backend/http/httpRouter.go` (template initialization) - `frontend/public/index.html` (insertion points for title/description and related fields)</p> <p>## PoC 1. Login as a user with share creation permission. 2. Create a share (`POST /api/share`) with malicious metadata: - `title = &lt;/title&gt;&lt;script&gt;alert(&#34;xss&#34;)&lt;/script&gt;&lt;title&gt;` 3. Open the resulting `/public/share/&lt;hash&gt;` URL in a browser. 4. **Expected:** Payload is safely escaped and displayed as text. 5. **Actual:** JavaScript executes in victim&#39;s browser (stored XSS).</p> <p>Tested on Docker image: `gtstef/filebrowser:stable` (version `v1.2.1-stable`).</p> <p>## Impact - Arbitrary script execution in application origin. - Potential account/session compromise, CSRF-like act…</p> <p><strong>Affected:</strong> Go: github.com/gtsteffaniak/filebrowser</p> <p>## Summary Stored XSS is possible via share metadata fields (e.g., `title`, `description`) that are rendered into HTML for `/public/share/&lt;hash&gt;` without context-aware escaping. The server uses `text/template` instead of `html/template`, allowing injected scripts to execute when victims visit the share URL.</p> <p>## Details The server renders `public/index.html` using `text/template` and injects user-controlled share fields (title/description/etc.) into HTML contexts. `text/template` does not perform HTML contextual escaping like `html/template`. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page.</p> <p>Relevant code paths: - `backend/http/static.go` (template rendering and share metadata assignment) - `backend/http/httpRouter.go` (template initialization) - `frontend/public/index.html` (insertion points for title/description and related fields)</p> <p>## PoC 1. Login as a user with share creation permission. 2. Create a share (`POST /api/share`) with malicious metadata: - `title = &lt;/title&gt;&lt;script&gt;alert(&#34;xss&#34;)&lt;/script&gt;&lt;title&gt;` 3. Open the resulting `/public/share/&lt;hash&gt;` URL in a browser. 4. **Expected:** Payload is safely escaped and displayed as text. 5. **Actual:** JavaScript executes in victim&#39;s browser (stored XSS).</p> <p>Tested on Docker image: `gtstef/filebrowser:stable` (version `v1.2.1-stable`).</p> <p>## Impact - Arbitrary script execution in application origin. - Potential account/session compromise, CSRF-like act…</p> https://cve.radiocsirt.org/vuln/ghsa-r633-fcgp-m532