FileBrowser Quantum CVE-2026-54685

No special configuration or elevated privileges are required - the timing side-channel exists in the default authentication code path of any internet-accessible FileBrowser Quantum instance prior to version 1.3.2-beta. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated exploitation against default deployments with no user interaction needed. Exploitation is bounded to username enumeration; the attacker cannot gain direct access without also obtaining or brute-forcing the corresponding password. Network jitter can theoretically reduce measurement reliability, but the published PoC mitigates this through multi-sample statistical calibration. Deployments restricted to internal networks or behind IP allowlists are not exploitable from the internet.

The CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects remote, unauthenticated exploitability with a limited confidentiality-only impact. The attack complexity is genuinely low - the GHSA PoC demonstrates automated calibration that compensates for network jitter using statistical baselining, making enumeration reliable. No EPSS data was provided, and the CVE is absent from CISA KEV, indicating no confirmed in-the-wild exploitation at time of analysis. The practical risk is not direct system compromise but reconnaissance: discovered valid usernames serve as the first stage of credential stuffing or targeted brute-force attacks against the bcrypt-protected login. For publicly internet-facing FileBrowser Quantum deployments, this is a meaningful exposure; for deployments restricted to internal networks, risk is substantially reduced. CVSS and description signals are consistent - no conflicts identified.

An unauthenticated remote attacker sends POST requests to /api/auth/login with a list of candidate usernames and a deliberately incorrect password, measuring the response time for each attempt. After calibrating a baseline latency using known-invalid usernames (~1-4 ms), the attacker identifies any response exceeding the statistical threshold (~40-50 ms) as belonging to a valid account. A PoC script automating this process with statistical calibration was published in the GHSA advisory.