FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) in github.com/gtsteffaniak/filebrowser

Description

References

• gtsteffaniak/filebrowser security advisory · ADVISORY
• gtsteffaniak/filebrowser commit 6bfc397 · FIX

More vulnerabilities in github.com/gtsteffaniak/filebrowser

• CVE-2026-46410HIGH 8.7FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive in…
• GO-2026-5776FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks in github.com/gtsteffaniak/filebrowser
• GHSA-r4v7-6wcg-ghj5MEDIUM 6.5FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks
• CVE-2026-44542CRITICAL 9.1FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is …
• GHSA-mmpx-jh39-wrv6MEDIUM 5.4FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)