FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

Vulnerability

CVE-2026-30934 is a stored cross-site scripting (XSS) vulnerability in FileBrowser Quantum, a self-hosted web file manager. Prior to versions 1.3.1-beta and 1.2.2-stable, the application uses text/template instead of html/template when rendering share metadata fields (e.g., title, description) into the public share page at /public/share/. This means user-controlled input is not contextually HTML-escaped, allowing an attacker to inject arbitrary JavaScript [1][3].

Exploitation

To exploit the vulnerability, an attacker must have permission to create shares. They can craft a share with malicious payloads in the metadata fields (e.g., ``). Once the share is saved, the payload is stored and executed in the browser of any user—including unauthenticated visitors—who opens the corresponding share URL [3]. No additional user interaction beyond visiting the link is required.

Impact

Successful exploitation enables arbitrary script execution in the context of the application's origin. This can lead to session hijacking, credential theft, data exfiltration, or performing actions on behalf of the victim, potentially compromising the entire application [2][3].

Mitigation

The vulnerability is fixed in versions 1.3.1-beta and 1.2.2-stable. Users should upgrade immediately. The fix replaces text/template with html/template to ensure proper context-aware escaping [1][4]. No workarounds are mentioned.