CVE-2026-27611: gtsteffaniak filebrowser quantum

csirt@kutim:~/threat-intel/cve/CVE-2026-27611

CVSS 6.5 · Medium EPSS 0,43%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada gtsteffaniak filebrowser quantum. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.

Rincian

Terbit di NVD: 25 Februari 2026
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-287: Improper Authentication
CWE-288: Authentication Bypass Using an Alternate Path or Channel
EPSS (30 hari): 0,43% peluang dieksploitasi; lebih tinggi dari 35,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
gtsteffaniak	filebrowser quantum	Semua versi sebelum 1.1.3
gtsteffaniak	filebrowser quantum	Versi 1.2.0 hingga sebelum 1.2.6
gtsteffaniak	filebrowser quantum	Versi 1.1.3 beta

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6 exploit · advisory vendor
https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1 patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.