{"id":"CVE-2026-30934","aliases":["GHSA-r633-fcgp-m532","GO-2026-4660"],"url":"https://o3.security/vulnerability/CVE-2026-30934","summary":"FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)","details":"## Summary\nStored XSS is possible via share metadata fields (e.g., `title`, `description`) that are rendered into HTML for `/public/share/<hash>` without context-aware escaping. The server uses `text/template` instead of `html/template`, allowing injected scripts to execute when victims visit the share URL.\n\n## Details\nThe server renders `public/index.html` using `text/template` and injects user-controlled share fields (title/description/etc.) into HTML contexts. `text/template` does not perform HTML contextual escaping like `html/template`. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page.\n\nRelevant code paths:\n- `backend/http/static.go` (template rendering and share metadata assignment)\n- `backend/http/httpRouter.go` (template initialization)\n- `frontend/public/index.html` (insertion points for title/description and related fields)\n\n## PoC\n1. Login as a user with share creation permission.\n2. Create a share (`POST /api/share`) with malicious metadata:\n   - `title = </title><script>alert(\"xss\")</script><title>`\n3. Open the resulting `/public/share/<hash>` URL in a browser.\n4. **Expected:** Payload is safely escaped and displayed as text.\n5. **Actual:** JavaScript executes in victim's browser (stored XSS).\n\nTested on Docker image: `gtstef/filebrowser:stable` (version `v1.2.1-stable`).\n\n## Impact\n- Arbitrary script execution in application origin.\n- Potential account/session compromise, CSRF-like action execution, data exfiltration from authenticated contexts.\n- Affects anyone (including unauthenticated visitors) opening the malicious share URL.\n- The XSS is stored and persistent — no social engineering beyond sharing the link is required.","published":"2026-03-10T16:12:23.434Z","modified":"2026-08-12T03:51:23.511944290Z","cvss":{"score":8.9,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"},"epss":{"score":0.00347,"percentile":0.28149,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/gtsteffaniak/filebrowser","fixedVersion":"0.0.0-20260307130210-09713b32a5f6"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable"},{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30934.json"},{"type":"ADVISORY","url":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r633-fcgp-m532"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30934"},{"type":"PACKAGE","url":"https://github.com/gtsteffaniak/filebrowser"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2026-4660"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:23.511944290Z"}}