GHSA-r633-fcgp-m532

Suggest an improvement
Source
https://github.com/advisories/GHSA-r633-fcgp-m532
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r633-fcgp-m532/GHSA-r633-fcgp-m532.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-r633-fcgp-m532
Aliases
Published
2026-03-09T19:48:15Z
Modified
2026-03-24T21:18:56Z
Severity
  • 8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator
Summary
FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)
Details

Summary

Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL.

Details

The server renders public/index.html using text/template and injects user-controlled share fields (title/description/etc.) into HTML contexts. text/template does not perform HTML contextual escaping like html/template. Because share metadata is persistent, the payload becomes stored and executes whenever a victim opens the affected share page.

Relevant code paths:

  • backend/http/static.go (template rendering and share metadata assignment)
  • backend/http/httpRouter.go (template initialization)
  • frontend/public/index.html (insertion points for title/description and related fields)

PoC

  1. Login as a user with share creation permission.
  2. Create a share (POST /api/share) with malicious metadata:
    • title = </title><script>alert("xss")</script><title>
  3. Open the resulting /public/share/<hash> URL in a browser.
  4. Expected: Payload is safely escaped and displayed as text.
  5. Actual: JavaScript executes in victim's browser (stored XSS).

Tested on Docker image: gtstef/filebrowser:stable (version v1.2.1-stable).

Impact

  • Arbitrary script execution in application origin.
  • Potential account/session compromise, CSRF-like action execution, data exfiltration from authenticated contexts.
  • Affects anyone (including unauthenticated visitors) opening the malicious share URL.
  • The XSS is stored and persistent — no social engineering beyond sharing the link is required.
Database specific 
{
    "cwe_ids": [
        "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-09T19:48:15Z",
    "nvd_published_at": "2026-03-10T18:18:53Z",
    "severity": "HIGH"
}
References

Affected packages

Go / github.com/gtsteffaniak/filebrowser

Package

Name
github.com/gtsteffaniak/filebrowser
View open source insights on deps.dev
Purl
pkg:golang/github.com/gtsteffaniak/filebrowser

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.0.0-20260307130210-09713b32a5f6

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-r633-fcgp-m532/GHSA-r633-fcgp-m532.json"