Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2026-27611

created 1 month, 2 weeks ago

FileBrowser Quantum: Password Protection Not Enforced on Shared File Links

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.

References

https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-8vrh-3pm2-v4v6 x_refsource_CONFIRM
https://github.com/gtsteffaniak/filebrowser/commit/c51b0ee9738fa4599b409f47c5bf820ef31b4fe1 x_refsource_MISC

Affected products

filebrowser

==< 1.1.3-stable
==>= 1.2.0-beta, < 1.2.6-beta

Matching in nixpkgs

pkgs.filebrowser

Filebrowser is a web application for managing files and directories

nixos-unstable 2.57.1
- nixpkgs-unstable 2.57.1
- nixos-unstable-small 2.57.1
nixos-25.11 2.57.1
- nixos-25.11-small 2.57.1
- nixpkgs-25.11-darwin 2.57.1

pkgs.filebrowser-quantum

Access and manage your files from the web

nixos-unstable 1.1.0-stable
- nixpkgs-unstable 1.1.0-stable
- nixos-unstable-small 1.1.0-stable

pkgs.python312Packages.filebrowser-safe

Snapshot of django-filebrowser for the Mezzanine CMS

nixos-25.11 1.1.1
- nixos-25.11-small 1.1.1
- nixpkgs-25.11-darwin 1.1.1

pkgs.python313Packages.filebrowser-safe

Snapshot of django-filebrowser for the Mezzanine CMS

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-25.11 1.1.1
- nixos-25.11-small 1.1.1
- nixpkgs-25.11-darwin 1.1.1

pkgs.python314Packages.filebrowser-safe

Snapshot of django-filebrowser for the Mezzanine CMS

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1

Package maintainers

@HritwikSinghal Hritwik Singhal <nix@thorin.theoakenshield.com>
@prikhi Pavan Rikhi <pavan.rikhi@gmail.com>
@Denperidge Cat <contact@denperidge.com>
@JocimSus Joachim Susatiyo <joe.susatiyo@gmail.com>