CVEReports
CVEReports

Automated vulnerability intelligence platform. Comprehensive reports for high-severity CVEs generated by AI.

Product

  • Home
  • Sitemap
  • RSS Feed

Company

  • About
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CVEReports. All rights reserved.

Made with love by Amit Schendel & Alon Barad



GHSA-MMPX-JH39-WRV6

GHSA-MMPX-JH39-WRV6: Stored Cross-Site Scripting in FileBrowser Quantum via SVG Rendering

Amit Schendel
Amit Schendel
Senior Security Researcher

May 7, 2026·6 min read·23 visits

Executive Summary (TL;DR)

FileBrowser Quantum allows Stored XSS via malicious SVG files served inline due to a missing Content-Security-Policy header. Attackers can execute arbitrary JavaScript in a victim's session.

FileBrowser Quantum versions prior to v1.3.1-stable and v1.3.9-beta are vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability manifests when the application serves user-uploaded Scalable Vector Graphics (SVG) files with the `inline` parameter. Due to the absence of a restrictive Content-Security-Policy (CSP) header, modern browsers execute embedded JavaScript within the application's origin context.

Vulnerability Overview

FileBrowser Quantum functions as a web-based file manager, allowing users to upload, manage, and share files. A core feature of this application is the ability to generate public share links for stored files. These files can be served directly to a user's browser for immediate viewing using the ?inline=true query parameter.

The vulnerability exists in how the application handles HTTP responses for inline content rendering. Specifically, the application sets the Content-Disposition: inline header without applying necessary security controls to the response. This configuration instructs the browser to render the file natively rather than prompting the user to download it.

Because the application serves these files from its primary origin, any active content within the rendered file executes in the context of the FileBrowser instance. The application fails to mitigate this behavior, lacking a Content Security Policy (CSP) header that would normally restrict script execution for untrusted user-uploaded files.

Root Cause Analysis

The underlying flaw is categorized as CWE-79: Improper Neutralization of Input During Web Page Generation, combined with CWE-693: Protection Mechanism Failure. The mechanism failure occurs in the backend HTTP handler responsible for file downloads and inline rendering.

Scalable Vector Graphics (SVG) files are XML-based documents capable of containing embedded JavaScript. The SVG specification allows for script execution through direct <script> tags or via event handlers such as onload. When a browser receives an SVG file with a Content-Type: image/svg+xml header and a Content-Disposition: inline header, it processes the document as a top-level execution context.

The FileBrowser Quantum backend routine setContentDisposition processes the incoming HTTP request and checks for the inline=true parameter. If present, it modifies the disposition type but returns the response without injecting a Content-Security-Policy header. The absence of this header permits the browser's rendering engine to parse and execute any JavaScript found within the SVG payload.

Code Analysis

The vulnerability resides in the Go backend, specifically within the backend/http/download.go file. The setContentDisposition function is responsible for determining whether a requested file should be downloaded as an attachment or displayed inline based on the query parameters.

In the vulnerable implementation, the function simply toggled the disposition string. It did not alter the security posture of the HTTP response. The browser relies on the server to assert execution boundaries, and the server failed to provide them.

The patch applied in commit 6bfc3974192e954f71cc5d1cd04baaaec3b76383 introduces a direct mitigation for this specific rendering path. The developers implemented a CSP header to explicitly disable script execution when a file is requested inline.

// backend/http/download.go (Patched)
 
func setContentDisposition(w http.ResponseWriter, r *http.Request, fileName string) {
    dispositionType := "attachment"
    if r.URL.Query().Get("inline") == "true" {
        dispositionType = "inline"
+       // Inline SVG (and similar) can execute embedded scripts when opened as a top-level document; 
+       // match upstream filebrowser mitigation.
+       w.Header().Set("Content-Security-Policy", "script-src 'none'")
    }
    // ...
}

By injecting w.Header().Set("Content-Security-Policy", "script-src 'none'"), the server explicitly instructs the browser that no scripts are permitted to run within this document. The browser's CSP engine enforces this policy during the parsing phase, neutralizing any <script> tags or event handlers present in the SVG file.

Exploitation Methodology

Exploitation requires an attacker to upload a crafted SVG file to the FileBrowser instance. The attacker must have sufficient privileges to upload files, though the required privilege level depends on the specific deployment configuration. Once the file is hosted, the attacker leverages the application's sharing functionality.

The attacker creates an SVG file containing a malicious JavaScript payload. A standard proof-of-concept payload utilizes the onload event handler within the main svg tag. This ensures the JavaScript executes immediately upon the document rendering in the victim's browser.

<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)">
    <circle cx="50" cy="50" r="40" stroke="black" stroke-width="3" fill="red" />
</svg>

After uploading the payload, the attacker generates a public share link. The attacker appends the ?inline=true query parameter to the URL and distributes it to the intended victim. When the victim navigates to the provided link, their browser fetches the file, observes the inline disposition, and renders the XML. The embedded JavaScript executes within the domain context of the FileBrowser application.

Impact Assessment

The successful exploitation of this vulnerability yields arbitrary JavaScript execution in the context of the FileBrowser application. Because the execution occurs within the application's origin, the attacker bypasses the Same-Origin Policy (SOP) restrictions that normally separate different web properties.

An attacker can utilize this access to interact with the application on behalf of the victim. If the victim is an authenticated user or an administrator, the attacker's script can issue XMLHttpRequests (XHR) to the backend API. This access permits the modification of files, deletion of data, or the creation of new administrative accounts.

The payload can also access sensitive data stored within the browser. This includes reading session tokens stored in localStorage, sessionStorage, or non-HttpOnly cookies. The extracted tokens can be exfiltrated to an attacker-controlled server, leading to full session hijacking.

Remediation and Mitigation

The primary remediation for this vulnerability is updating the FileBrowser Quantum deployment to a patched version. The maintainer released fixes in versions v1.3.1-stable and v1.3.9-beta. These updates apply the CSP header fix natively within the application binary.

If immediate patching is not feasible, administrators can mitigate the vulnerability at the reverse proxy layer. Web servers such as NGINX or Apache can be configured to dynamically inject the Content-Security-Policy: script-src 'none' header based on the request URL. Specifically, the proxy can inspect the query parameters and append the header if inline=true is detected.

Furthermore, administrators should review the necessity of allowing public shares or inline rendering. Restricting the inline parameter at the WAF level prevents the vulnerability from being triggered entirely, forcing all shared files to download as attachments rather than executing in the browser.

Official Patches

gtsteffaniakSource code patch introducing CSP header
gtsteffaniakOfficial project release page for patched binaries

Fix Analysis (1)

Technical Appendix

CVSS Score
5.4/ 10

Affected Systems

FileBrowser Quantum (github.com/gtsteffaniak/filebrowser)

Affected Versions Detail

Product
Affected Versions
Fixed Version
FileBrowser Quantum
gtsteffaniak
< v1.3.1-stablev1.3.1-stable
FileBrowser Quantum
gtsteffaniak
< v1.3.9-betav1.3.9-beta
AttributeDetail
Vulnerability TypeStored Cross-Site Scripting (XSS)
CWE IDCWE-79, CWE-693
Attack VectorNetwork
Authentication StatusRequired for upload, unauthenticated for victim execution
Affected Componentbackend/http/download.go
Exploit AvailabilityProof of Concept available

MITRE ATT&CK Mapping

T1190Exploit Public-Facing Application
Initial Access
T1059.007JavaScript
Execution
CWE-79
Cross-site Scripting

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Vulnerability Timeline

Fix commit pushed to repository
2026-05-01
Patched versions v1.3.1-stable and v1.3.9-beta released
2026-05-01

References & Sources

  • [1]GitHub Advisory GHSA-mmpx-jh39-wrv6
  • [2]Fix Commit in gtsteffaniak/filebrowser
  • [3]Project Releases Page
  • [4]Go Vulnerability Database Entry

Attack Flow Diagram

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.
Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

More Reports

•about 1 hour ago•CVE-2026-63349
7.0

CVE-2026-63349: Privilege Dropping Bypass and Denial of Service in AnyIO Subprocess Module

CVE-2026-63349 is a critical privilege-dropping bypass vulnerability in the AnyIO asynchronous framework (versions 4.14.0 and 4.14.1) on POSIX platforms. Due to a variable assignment typo, supplementary groups specified by the developer are not correctly propagated to the execution backend, resulting in subprocesses retaining the parent process's elevated supplementary group permissions.

Alon Barad
Alon Barad
5 views•5 min read
•about 2 hours ago•CVE-2026-63406
5.9

CVE-2026-63406: Information Disclosure via Insecure Telemetry and Hardcoded Credentials in AnyCable-Go

CVE-2026-63406 is an information disclosure vulnerability in AnyCable-go prior to version 1.6.15. The built-in telemetry client is enabled by default with a hardcoded public authentication token ('secret'). This client digests highly sensitive configuration parameters and command-line arguments, including JWT secrets and RPC secrets, into a stable SHA-256 fingerprint. This fingerprint is sent over public networks, exposing those administrative secrets to offline dictionary and brute-force attacks if intercepted.

Alon Barad
Alon Barad
4 views•5 min read
•about 3 hours ago•CVE-2026-84992
6.1

CVE-2026-84992: Cross-Site Scripting (XSS) via Fenced Code Block Parsing in md-editor-v3

CVE-2026-84992 is a Cross-Site Scripting (XSS) vulnerability affecting md-editor-v3 before version 6.5.4. It occurs because the fenced-code block language parser directly interpolates unescaped language metadata into unquoted HTML attributes inside the custom rendering callback. This bypasses the built-in XSSPlugin which runs during the parsing phase, before rendering.

Amit Schendel
Amit Schendel
7 views•6 min read
•about 4 hours ago•CVE-2026-81505
7.1

CVE-2026-81505: Broken Object Level Authorization (BOLA) in Convoy Webhook Source Retrieval

CVE-2026-81505 is a high-severity Broken Object Level Authorization (BOLA) / Insecure Direct Object Reference (IDOR) vulnerability in Convoy, a cloud-native webhooks gateway. In affected versions prior to 26.6.8, the single-item Source retrieval API endpoint authorizes project access but fails to confirm if the requested Source belongs to that specific project. This logical flaw allows authenticated users or project-scoped API key holders to bypass tenant isolation boundaries and retrieve unredacted, plaintext message broker credentials for Apache Kafka, Amazon SQS, RabbitMQ, and Google Cloud Pub/Sub belonging to other tenants. This issue is fully patched in version 26.6.8.

Amit Schendel
Amit Schendel
8 views•5 min read
•about 5 hours ago•CVE-2026-77339
5.1

CVE-2026-77339: Unauthenticated Remote Command Execution in Process Compose via DNS Rebinding

CVE-2026-77339 is a critical security vulnerability in Process Compose before version 1.120.0. The Model Context Protocol (MCP) Server-Sent Events (SSE) listener transport subsystem fails to validate the HTTP Host and Origin headers, and does not enforce authentication. This omissions expose local loopback listeners to DNS rebinding attacks orchestrated by malicious remote websites visited by developers, enabling unauthorized process control and arbitrary command execution.

Alon Barad
Alon Barad
8 views•6 min read
•about 6 hours ago•CVE-2026-77301
7.5

CVE-2026-77301: Uncontrolled Resource Allocation (Decompression Bomb) in adm-zip

CVE-2026-77301 is a critical uncontrolled resource allocation vulnerability in the popular Node.js library adm-zip (versions prior to 0.6.1). During ZIP decompression of asynchronous entries, the library trusts the uncompressed size metadata declared in the central directory headers. Because Node.js's streaming zlib API completely ignores the maxOutputLength configuration, a crafted ZIP archive (decompression bomb) causes the application to continually allocate resident memory buffers on the heap without limits, causing rapid memory exhaustion and a process-level Out-of-Memory (OOM) crash.

Alon Barad
Alon Barad
6 views•5 min read