What is the CVSS score of CVE-2026-30933?

CVE-2026-30933 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Filebrowser are affected by CVE-2026-30933?

FileBrowser Quantum contains a high-severity vulnerability (CVE-2026-30933) affecting self-hosted file manager deployments.. A patch is available.

How to fix or mitigate CVE-2026-30933?

Within 24 hours: Identify all FileBrowser Quantum instances in your environment and document versions currently deployed. Within 7 days: Implement network segmentation to restrict access to FileBrowser Quantum to trusted users only; consider disabling the application if not business-critical until patched. Within 30 days: Monitor vendor releases for version 1.3.1-beta or 1.2.2-stable availability and apply patches immediately upon release; establish a process to track CVE-2026-27611 and related disclosures.

Filebrowser CVE-2026-30933

HIGH

Information Exposure (CWE-200)

2026-03-10 security-advisories@github.com

GHSA-525j-95gf-766f

Information Disclosure Filebrowser Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.5

DescriptionGitHub Advisory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

AnalysisAI

FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable leak authentication tokens through the /public/api/share/info endpoint, allowing unauthenticated attackers to bypass password protections on shared files. The vulnerability stems from an incomplete fix to CVE-2026-27611 and enables token disclosure that could facilitate unauthorized file access. No patch is currently available for affected installations.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects web-based file manager.. FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.