CVE-2026-30933: 
NixOS vulnerability analysis and mitigation

CVE-2026-30933 is an incomplete remediation vulnerability in FileBrowser Quantum, a free self-hosted web-based file manager, that allows unauthenticated attackers to bypass password protection on shared files by retrieving tokenized download URLs. It represents an incomplete fix for the previously disclosed CVE-2026-27611. Affected versions include 1.3.0-beta, 1.2.1-stable, and all versions up to and including 1.2.9 (stable branch). The vulnerability was published on March 7, 2026, and patched versions were released the same day. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Security Advisory).

The root cause lies in two related flaws classified as CWE-200 (Exposure of Sensitive Information), CWE-306 (Missing Authentication for Critical Function), and CWE-602 (Client-Side Enforcement of Server-Side Security). In backend/http/share.go, the convertToFrontendShareResponse function writes a tokenized download URL — including the bearer token as a query parameter — into the persistent share model (s.DownloadURL = getShareURL(r, s.Hash, true, s.Token)). The public endpoint GET /public/api/share/info then returns the CommonShare object without sanitizing or clearing the DownloadURL field, meaning any unauthenticated caller who knows a share hash can retrieve a fully valid, pre-authenticated download URL. The prior patch for CVE-2026-27611 removed token generation in one handler but failed to address the persisted DownloadURL values already stored and reflected by the public API (Security Advisory).

An unauthenticated remote attacker can retrieve the tokenized download URL for any password-protected share by querying the public /public/api/share/info endpoint with only the share hash, then use that URL to download the protected file without ever supplying the share password. This results in a complete confidentiality bypass for all password-protected shares, exposing potentially sensitive files to unauthorized parties. There is no integrity or availability impact, but any data stored in password-protected shares on an affected instance should be considered potentially compromised (Security Advisory, Github Advisory).

A detailed proof-of-concept exploit is publicly available in the official security advisory, including specific curl commands and step-by-step instructions for bypassing password protection (Security Advisory). The vulnerability requires no authentication, no user interaction, and no special privileges — only knowledge of a share hash (which may be guessable or obtainable via the share URL). The EPSS score is approximately 0.053–0.107% (28th percentile), indicating a relatively low but non-negligible probability of exploitation in the wild. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing FileBrowser Quantum instances (versions prior to 1.2.2-stable or 1.3.1-beta) using tools like Shodan or Censys, or by targeting known deployments.
2. Obtain a share hash: Acquire the public share URL for a password-protected share (e.g., http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw). The hash portion (2EBGbXgXg5dpw-nK0RG6vw) is the only required input.
3. Query the public share info endpoint: Send an unauthenticated HTTP GET request to the /public/api/share/info endpoint with the share hash:

   curl 'http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw' -H 'Accept: */*'

4. Extract the tokenized download URL: Parse the JSON response and locate the downloadURL field, which contains a pre-authenticated URL with a bearer token embedded as a query parameter (e.g., ?token=EGGYjfyMgqlqknDAIjXekI3DXJ40Nxht...).
5. Download the protected file: Replace \u0026 with & in the extracted URL and navigate to it in a browser or via curl. The file downloads immediately without requiring the share password (Security Advisory).

• Network: Unauthenticated HTTP GET requests to /public/api/share/info with a hash query parameter, especially from IPs that do not subsequently authenticate or provide a share password; follow-on requests to /public/api/resources/download with a token query parameter from the same source IP.
• Logs: Web server access logs showing repeated or automated queries to /public/api/share/info?hash=<value> without corresponding authenticated sessions; download requests to /public/api/resources/download with token= parameters from unauthenticated sessions.
• Behavioral: Multiple share hashes queried in rapid succession from a single IP, suggesting enumeration of share hashes; file downloads occurring for password-protected shares without any password submission event in application logs (Security Advisory).

Upgrade FileBrowser Quantum to version 1.2.2-stable or 1.3.1-beta (or later), both released on March 7, 2026, which sanitize the DownloadURL field before returning the JSON response from shareInfoHandler (v1.2.2-stable Release, v1.3.1-beta Release). As a temporary workaround if upgrading is not immediately possible, implement network-level access controls (e.g., firewall rules or reverse proxy restrictions) to block unauthenticated external access to the /public/api/share/info endpoint. Additionally, review and revoke any password-protected shares created prior to patching, as their download tokens may have already been exposed (Github Advisory).

The vulnerability was reported by researcher mdcoxe and analyzed by ByteAfterLife, with the advisory published directly by the project maintainer gtsteffaniak on March 7, 2026 (Security Advisory). Brief community discussion was noted on Mastodon via @thehackerwire, and the CVE was picked up by automated vulnerability tracking feeds including VulDB and radar.offseq.com shortly after disclosure. No major media coverage or significant vendor statements beyond the official advisory have been identified.