What is the CVSS score of CVE-2026-30934?

CVE-2026-30934 has a CVSS 3.1 base score of 8.9 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Filebrowser are affected by CVE-2026-30934?

FileBrowser Quantum deployments are vulnerable to Stored Cross-Site Scripting (XSS) attacks through share metadata fields, allowing attackers to inject malicious code that executes when users access…. A patch is available.

How to fix or mitigate CVE-2026-30934?

Within 24 hours: Inventory all FileBrowser Quantum instances and versions in production; disable public share functionality if business operations permit. Within 7 days: Implement Web Application Firewall rules to sanitize or block suspicious characters in share metadata parameters; isolate FileBrowser instances to trusted networks only. Within 30 days: Monitor vendor release channels for patched versions 1.3.1-beta or 1.2.2-stable and plan immediate upgrade; conduct security awareness training on risks of clicking untrusted shared links.

Filebrowser CVE-2026-30934

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-10 security-advisories@github.com

GHSA-r633-fcgp-m532

XSS Filebrowser Suse

8.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.9 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 8.9

DescriptionGitHub Advisory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

AnalysisAI

Stored cross-site scripting in FileBrowser versions prior to 1.3.1-beta and 1.2.2-stable allows authenticated attackers to inject malicious scripts through share metadata fields that are improperly rendered without HTML escaping. When victims visit affected share URLs, the injected scripts execute in their browsers with full privileges, potentially leading to session hijacking, credential theft, or further compromise. A patch is available in the fixed versions, though exploitation currently shows 0% adoption likelihood.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Affects web-based file manager.. FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

RemediationAI

Fixed in version 1.3.1. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.