CVE-2026-27611Disclosure(gtsteffaniak / filebrowser_quantum)

LOWCVSS 6.5 · MEDIUM

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.

gtsteffaniak CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1

Exploit / PoC references

Weakness type (CWE)

CWE-200CWE-287CWE-288

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

filebrowser_quantum

Threat summary

5 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 2 signals
Disclosure: 3 classified signals
General: 2 classified signals
Peaked 1d ago at 3 mentions (2026-02-25); latest day: 2
5 total mentions across 2 days

Affected systems

Vendors

gtsteffaniak

Products

filebrowser_quantum

1 version affected across 1 product

Deep dive

Activity timeline5 mentions / 2d

Signal classification2 categories

Disclosure

360.0%

General

240.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-02-25	3	Disclosure3
2026-03-18	2	General2

Full discourse5 posts

Vulmon Vulnerability Feed@VulmonFeeds227d
Disclosure
CVE-2026-27611 Authentication Bypass in FileBrowser Quantum Enabling Unauthorized File Downloads https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27611
Post summary
A new authentication bypass vulnerability (CVE-2026-27611) in FileBrowser Quantum allows unauthorized file downloads.
0000154
4.0K followersView on X
Infoflowcloud@infoflowcloud206d
General
🚨*CVE* CVE-2026-30933 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password p… https://www.cve.org/CVERecord?id=CVE-2026-30933 ----- Traducción: CVE-2026-30933 Fil… http://infoflow.cloud`
Post summary
The post briefly references CVE-2026-30933 and notes incomplete remediation of a related CVE, without providing technical details, PoCs, or evidence of exploitation.
0000036
60 followersView on X
CVE@CVEnew206d
General
CVE-2026-30933 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password p… https://www.cve.org/CVERecord?id=CVE-2026-30933
Post summary
The post merely references CVE‑2026‑30933 and links to its CVE record, without providing details on the vulnerability, exploitation, or remediation.
00000199
56.7K followersView on X
cvereports@_cvereports226d
Disclosure
CVE-2026-27611: The 'Secure' Share That Wasn't: Bypassing FileBrowser Quantum FileBrowser Quantum, a popular self-hosted file management solution, suffered from a critical logic flaw in its sharing mechanism. Intended to protect files with passwords, ... https://cvereports.com/reports/CVE-2026-27611
Post summary
FileBrowser Quantum suffers a critical logic flaw in its sharing mechanism that bypasses password protection, as reported in CVE-2026-27611.
0000032
31 followersView on X
CVE@CVEnew227d
Disclosure
CVE-2026-27611 FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the reci… https://www.cve.org/CVERecord?id=CVE-2026-27611
Post summary
The post announces a vulnerability in FileBrowser Quantum where password‑protected file sharing can be bypassed in versions prior to 1.1.3‑stable and 1.2.6‑beta.
00000117
56.6K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	gtsteffaniak	filebrowser_quantum	-	-	-
App	gtsteffaniak	filebrowser_quantum	1.1.3	-	-

Explore more

Back to dashboard gtsteffaniak CVEs filebrowser_quantum vulnerabilities

What researchers are saying

CVE-2026-27611

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new authentication bypass vulnerability (CVE-2026-27611) in FileBrowser Quantum allows unauthorized file downloads.

Infoflowcloud@infoflowcloudGeneral

The post briefly references CVE-2026-30933 and notes incomplete remediation of a related CVE, without providing technical details, PoCs, or evidence of exploitation.

CVE@CVEnewGeneral

The post merely references CVE‑2026‑30933 and links to its CVE record, without providing details on the vulnerability, exploitation, or remediation.

cvereports@_cvereportsDisclosure

FileBrowser Quantum suffers a critical logic flaw in its sharing mechanism that bypasses password protection, as reported in CVE-2026-27611.

CVE@CVEnewDisclosure

The post announces a vulnerability in FileBrowser Quantum where password‑protected file sharing can be bypassed in versions prior to 1.1.3‑stable and 1.2.6‑beta.