Every CVESearch/Get API key

GHSA-mmpx-jh39-wrv6

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

5.4 MediumFix available

GHSA-mmpx-jh39-wrv6 is a medium vulnerability (CVSS 5.4) in github.com/gtsteffaniak/filebrowser, published May 7, 2026. No source lists public exploit code. Fixed in github.com/gtsteffaniak/filebrowser 0.0.0-20260501184955-6bfc3974192e.

What does this mean?
Severity
5.4 MediumCVSS 3.1, GitHub Advisories
Exploit chance
UnscoredNo EPSS score yet
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.0.0-20260501184955-6bfc3974192egithub.com/gtsteffaniak/filebrowser

Description

Summary

FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.

Verified on v1.3.0-stable.

Affected product

  • Product: FileBrowser Quantum (gtsteffaniak/filebrowser)
  • Verified version: v1.3.0-stable
  • Docker image: gtstef/filebrowser:latest
  • Affected endpoint: GET /public/api/resources/download?hash=HASH&inline=true
  • CWE: CWE-79 — Cross-site Scripting (Stored)

Impact

  • Stored XSS — Malicious SVG persists and executes for every visitor to the share link
  • No authentication required to trigger — Public share links are accessible to anyone
  • Session hijacking — If authenticated users click the link, their session can be stolen
  • Phishing — Attacker can redirect or overlay fake login forms

Reproduction

  1. Login as any user with upload permission
  2. Upload SVG file:
    <svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.domain)</script>
</svg>
  3. Create public share for the file
  4. Access the share link with ?inline=true
  5. JavaScript executes in browser

Root cause

The inline download endpoint returns SVG files with:

Content-Type: image/svg+xml
Content-Disposition: inline; filename="xss.svg"
X-Content-Type-Options: nosniff

But no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:

Content-Security-Policy: script-src 'none'

Suggested fix

Add CSP header on inline file downloads:

w.Header().Set("Content-Security-Policy", "script-src 'none'")

This matches the upstream filebrowser/filebrowser implementation.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Affected packages

Affected packages
PackageAffectedFixed
github.com/gtsteffaniak/filebrowser
Go
before 0.0.0-20260501184955-6bfc3974192e
0.0.0-20260501184955-6bfc3974192e

What each source reports

GitHub Advisories Score used5.4

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Summary

FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.

Verified on v1.3.0-stable.

Affected product

  • Product: FileBrowser Quantum (gtsteffaniak/filebrowser)
  • Verified version: v1.3.0-stable
  • Docker image: gtstef/filebrowser:latest
  • Affected endpoint: GET /public/api/resources/download?hash=HASH&inline=true
  • CWE: CWE-79 — Cross-site Scripting (Stored)

Impact

  • Stored XSS — Malicious SVG persists and executes for every visitor to the share link
  • No authentication required to trigger — Public share links are accessible to anyone
  • Session hijacking — If authenticated users click the link, their session can be stolen
  • Phishing — Attacker can redirect or overlay fake login forms

Reproduction

  1. Login as any user with upload permission
  2. Upload SVG file:
    <svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.domain)</script>
</svg>
  3. Create public share for the file
  4. Access the share link with ?inline=true
  5. JavaScript executes in browser

Root cause

The inline download endpoint returns SVG files with:

Content-Type: image/svg+xml
Content-Disposition: inline; filename="xss.svg"
X-Content-Type-Options: nosniff

But no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:

Content-Security-Policy: script-src 'none'

Suggested fix

Add CSP header on inline file downloads:

w.Header().Set("Content-Security-Policy", "script-src 'none'")

This matches the upstream filebrowser/filebrowser implementation.

Record
GHSA-mmpx-jh39-wrv6
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV5.4

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Summary

FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links.

Verified on v1.3.0-stable.

Affected product

  • Product: FileBrowser Quantum (gtsteffaniak/filebrowser)
  • Verified version: v1.3.0-stable
  • Docker image: gtstef/filebrowser:latest
  • Affected endpoint: GET /public/api/resources/download?hash=HASH&inline=true
  • CWE: CWE-79 — Cross-site Scripting (Stored)

Impact

  • Stored XSS — Malicious SVG persists and executes for every visitor to the share link
  • No authentication required to trigger — Public share links are accessible to anyone
  • Session hijacking — If authenticated users click the link, their session can be stolen
  • Phishing — Attacker can redirect or overlay fake login forms

Reproduction

  1. Login as any user with upload permission
  2. Upload SVG file:
    <svg xmlns="http://www.w3.org/2000/svg">
  <script>alert(document.domain)</script>
</svg>
  3. Create public share for the file
  4. Access the share link with ?inline=true
  5. JavaScript executes in browser

Root cause

The inline download endpoint returns SVG files with:

Content-Type: image/svg+xml
Content-Disposition: inline; filename="xss.svg"
X-Content-Type-Options: nosniff

But no CSP header to block script execution. The upstream project (filebrowser/filebrowser) mitigates this with:

Content-Security-Policy: script-src 'none'

Suggested fix

Add CSP header on inline file downloads:

w.Header().Set("Content-Security-Policy", "script-src 'none'")

This matches the upstream filebrowser/filebrowser implementation.

Record
GHSA-mmpx-jh39-wrv6
CVSS 3.1
5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVGO-2026-5511No score

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) in github.com/gtsteffaniak/filebrowser

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header) in github.com/gtsteffaniak/filebrowser

Record
GO-2026-5511
Updated
2026-11-02

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open