QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2026-27611

Back to search

CVE-2026-27611

Published: Feb 25, 2026

Modified: Feb 27, 2026

PUBLISHED

Description

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.

VendorProductVersions

gtsteffaniak

filebrowser

affected
< 1.1.3-stable
affected
>= 1.2.0-beta, < 1.2.6-beta

Weaknesses (CWE)

CWE-200
CWE-288
CWE-287

References

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now