CVE-2026-27611: Gtsteffaniak Filebrowser Quantum

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.

Affected products

• Gtsteffaniak Filebrowser Quantum: before 1.1.3 (fixed in 1.1.3); from 1.2.0, before 1.2.6 (fixed in 1.2.6); version 1.1.3 only

Published 2026-02-25. Last modified 2026-06-17.