{"id":"GHSA-r633-fcgp-m532","summary":"FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)","details":"## Summary\nStored XSS is possible via share metadata fields (e.g., `title`, `description`) that are rendered into HTML for `/public/share/\u003chash\u003e` without context-aware escaping. The server uses `text/template` instead of `html/template`, allowing injected scripts to execute when victims visit the share URL.\n\n## Details\nThe server renders `public/index.html` using `text/template` and injects user-controlled share fields (title/description/etc.) into HTML contexts. `text/template` does not perform HTML contextual escaping like `html/template`. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page.\n\nRelevant code paths:\n- `backend/http/static.go` (template rendering and share metadata assignment)\n- `backend/http/httpRouter.go` (template initialization)\n- `frontend/public/index.html` (insertion points for title/description and related fields)\n\n## PoC\n1. Login as a user with share creation permission.\n2. Create a share (`POST /api/share`) with malicious metadata:\n   - `title = \u003c/title\u003e\u003cscript\u003ealert(\"xss\")\u003c/script\u003e\u003ctitle\u003e`\n3. Open the resulting `/public/share/\u003chash\u003e` URL in a browser.\n4. **Expected:** Payload is safely escaped and displayed as text.\n5. **Actual:** JavaScript executes in victim's browser (stored XSS).\n\nTested on Docker image: `gtstef/filebrowser:stable` (version `v1.2.1-stable`).\n\n## Impact\n- Arbitrary script execution in application origin.\n- Potential account/session compromise, CSRF-like action execution, data exfiltration from authenticated contexts.\n- Affects anyone (including unauthenticated visitors) opening the malicious share URL.\n- The XSS is stored and persistent — no social engineering beyond sharing the link is required.","aliases":["CVE-2026-30934","GO-2026-4660"],"modified":"2026-03-24T21:18:56.917701Z","published":"2026-03-09T19:48:15Z","database_specific":{"cwe_ids":["CWE-79"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-03-09T19:48:15Z","nvd_published_at":"2026-03-10T18:18:53Z"},"references":[{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-r633-fcgp-m532"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30934"},{"type":"PACKAGE","url":"https://github.com/gtsteffaniak/filebrowser"},{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.2.2-stable"},{"type":"WEB","url":"https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.1-beta"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2026-4660"}],"affected":[{"package":{"name":"github.com/gtsteffaniak/filebrowser","ecosystem":"Go","purl":"pkg:golang/github.com/gtsteffaniak/filebrowser"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.0.0-20260307130210-09713b32a5f6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r633-fcgp-m532/GHSA-r633-fcgp-m532.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L"}]}