Go/github.com/gtsteffaniak/filebrowser/backend CVE-2026-27611: medium 6.5, EPSS 0.37%

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

Action: Upgrade github.com/gtsteffaniak/filebrowser/backend to 0.0.0-20260221163904-dbcfba993b85 or later.

go get github.com/gtsteffaniak/filebrowser/backend@v0.0.0-20260221163904-dbcfba993b85

Affected

Fixed versions

Sources

• osv: GHSA-8vrh-3pm2-v4v6
• https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6
• https://nvd.nist.gov/vuln/detail/CVE-2026-27611
• https://github.com/gtsteffaniak/filebrowser/commit/a8c9b9419ec530568991a2f72cec4ed263f99e3c
• https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1
• https://github.com/gtsteffaniak/filebrowser
• https://pkg.go.dev/vuln/GO-2026-4546

CVE-2026-27611 · published 2026-02-25T16:00:49Z · modified 2026-05-05T15:55:59.579703Z · JSON