CVE-2026-30934

🗓️ 10 Mar 2026 16:12:23Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 17 Views🌐 WEB

Stored cross-site scripting on public share page from unsanitized share metadata rendered with text template.

Reporter	Title	Published	Views	Family All 126
Circl	CVE-2026-30934	7 Mar 202613:00	–	circl
CNNVD	FileBrowser Quantum 跨站脚本漏洞	10 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-30934 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)	10 Mar 202616:12	–	cvelist
Github Security Blog	FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)	9 Mar 202619:48	–	github
NVD	CVE-2026-30934	10 Mar 202618:18	–	nvd
OSV	CVE-2026-30934 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)	10 Mar 202616:12	–	osv
OSV	GHSA-R633-FCGP-M532 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)	9 Mar 202619:48	–	osv
OSV	GO-2026-4660 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) in github.com/gtsteffaniak/filebrowser	11 Mar 202616:00	–	osv
OSV	SUSE-SU-2026:1042-1 Security update for govulncheck-vulndb	25 Mar 202615:06	–	osv
Positive Technologies	PT-2021-16518	15 Jul 202100:00	–	ptsecurity

NVD

Vulners

Node

filebrowser filebrowserRange≤1.2.9

filebrowser filebrowserMatch1.2.1stable

filebrowser filebrowserMatch1.3.0beta

[
  {
    "vendor": "gtsteffaniak",
    "product": "filebrowser",
    "versions": [
      {
        "version": ">= 1.3.0-beta, < 1.3.1-beta",
        "status": "affected"
      },
      {
        "version": "< 1.2.2-stable",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable
github	www.github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta
github	www.github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r633-fcgp-m532

Parameter	Position	Path	Description	CWE
title	path	/public/share/<hash>	Stored XSS via share metadata fields rendered into HTML without proper escaping in the share page.	CWE-79
description	path	/public/share/<hash>	Stored XSS via share metadata fields rendered into HTML without proper escaping in the share page.	CWE-79

17 Jun 2026 10:33Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.4 - 8.9

EPSS0.00347

SSVC

CWE-79