{"schema_version":"1.7.5","id":"GHSA-r633-fcgp-m532","published":"2026-03-09T19:48:15Z","modified":"2026-03-24T21:17:27.316955Z","aliases":["CVE-2026-30934","GO-2026-4660"],"summary":"FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)","details":"## Summary\nStored XSS is possible via share metadata fields (e.g., `title`, `description`) that are rendered into HTML for `/public/share/<hash>` without context-aware escaping. The server uses `text/template` instead of `html/template`, allowing injected scripts to execute when victims visit the share URL.\n\n## Details\nThe server renders `public/index.html` using `text/template` and injects user-controlled share fields (title/description/etc.) into HTML contexts. `text/template` does not perform HTML contextual escaping like `html/template`. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page.\n\nRelevant code paths:\n- `backend/http/static.go` (template rendering and share metadata assignment)\n- `backend/http/httpRouter.go` (template initialization)\n- `frontend/public/index.html` (insertion points for title/description and related fields)\n\n## PoC\n1. Login as a user with share creation permission.\n2. Create a share (`POST /api/share`) with malicious metadata:\n   - `title = </title><script>alert(\"xss\")</script><title>`\n3. Open the resulting `/public/share/<hash>` URL in a browser.\n4. **Expected:** Payload is safely escaped and displayed as text.\n5. **Actual:** JavaScript executes in victim's browser (stored XSS).\n\nTested on Docker image: `gtstef/filebrowser:stable` (version `v1.2.1-stable`).\n\n## Impact\n- Arbitrary script execution in application origin.\n- Potential account/session compromise, CSRF-like action execution, data exfiltration from authenticated contexts.\n- Affects anyone (including unauthenticated visitors) opening the malicious share URL.\n- The XSS is stored and persistent — no social engineering beyond sharing the link is required.","affected":[{"package":{"name":"github.com/gtsteffaniak/filebrowser","ecosystem":"Go","purl":"pkg:golang/github.com/gtsteffaniak/filebrowser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260307130210-09713b32a5f6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r633-fcgp-m532/GHSA-r633-fcgp-m532.json"}}],"references":[{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r633-fcgp-m532"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30934"},{"type":"PACKAGE","url":"https://github.com/gtsteffaniak/filebrowser"},{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable"},{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2026-4660"}],"database_specific":{"cwe_ids":["CWE-79"],"github_reviewed":true,"github_reviewed_at":"2026-03-09T19:48:15Z","nvd_published_at":"2026-03-10T18:18:53Z","severity":"HIGH"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"}]}