8.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30934

CVE-2026-30934: FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30934

CVE-2026-30934:

8.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/gtsteffaniak/filebrowser	go	< 0.0.0-20260307130210-09713b32a5f6	0.0.0-20260307130210-09713b32a5f6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a stored Cross-Site Scripting (XSS) issue in the public share page of gtsteffaniak/filebrowser. The root cause is the use of Go's text/template package instead of the more secure html/template package for rendering HTML. The text/template package does not perform any HTML escaping, allowing user-provided data to be rendered as raw HTML.

The analysis of the commits between the vulnerable version (v1.2.1-stable) and the patched version (v1.2.2-stable) revealed the fixing commit 82c0182c2286b01b55944b7c01608b85d015257b. This commit explicitly replaces the text/template import with html/template in backend/http/static.go and backend/http/httpRouter.go.

The function handleWithStaticData in backend/http/static.go is identified as the main vulnerable function. It is responsible for gathering the data to be rendered on the public share page, including user-controlled share metadata like title and description. This data was then passed to the insecure TemplateRenderer.Render function, which used text/template to generate the HTML, leading to the execution of any embedded JavaScript.

The patch addresses this by not only switching to html/template but also by correctly typing the data passed to the template using template.CSS and template.JS, ensuring that user-supplied content is safely rendered.

Vulnerable functions

handleWithStaticData

backend/http/static.go

The `handleWithStaticData` function was vulnerable because it constructed the data payload for the template using `text/template`, which does not perform context-aware HTML escaping. User-controlled data from share metadata (like `title` and `description`) was passed into the template without sanitization. The patch replaces `text/template` with `html/template` and uses `template.CSS` and `template.JS` to mark content as safe, thus preventing the XSS vulnerability.

TemplateRenderer.Render

backend/http/static.go

The `Render` method of the `TemplateRenderer` struct was responsible for executing the template. Before the patch, it used `text/template` which led to the XSS vulnerability. The patch changes the implementation to use `html/template`, which provides automatic contextual escaping of data, mitigating the vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.