CVE-2026-30934: 
NixOS vulnerability analysis and mitigation

CVE-2026-30934 is a stored Cross-Site Scripting (XSS) vulnerability in FileBrowser Quantum, a Go-based self-hosted file management application. The flaw exists in the public share page, where user-controlled share metadata fields (e.g., title, description) are rendered into HTML without context-aware escaping due to the server's use of Go's text/template instead of html/template. Affected versions include all releases up to and including v1.2.1-stable and v1.3.0-beta. It was disclosed on March 7, 2026, by researcher lulaide via a GitHub Security Advisory, and published to the NVD on March 10, 2026. The GitHub Advisory Database rates this vulnerability as High severity with a CVSS v3.1 score of 8.9 (GitHub Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically arising from the misuse of Go's text/template package — which performs no HTML contextual escaping — instead of the safer html/template package when rendering public/index.html (GitHub Advisory). User-controlled share metadata (title, description, etc.) is injected directly into HTML contexts via the backend code paths in backend/http/static.go and backend/http/httpRouter.go, with insertion points in frontend/public/index.html. An attacker with share-creation privileges (low-privileged user) can craft a malicious share via POST /api/share with a payload such as <script>alert("xss")</script> in the title field; the payload is stored server-side and executes in any visitor's browser upon accessing the /public/share/<hash> URL. No further interaction beyond opening the share link is required from the victim (GitHub Security Advisory).

Successful exploitation enables arbitrary JavaScript execution in the application's origin context, affecting any user — including unauthenticated visitors — who opens the malicious share URL. Because the XSS payload is stored persistently, it executes on every visit without requiring repeated attacker interaction. Potential consequences include session hijacking, account compromise, CSRF-like unauthorized action execution on behalf of authenticated users, and exfiltration of sensitive data accessible within the authenticated application context (GitHub Advisory, GitHub Security Advisory).

A public proof-of-concept with step-by-step reproduction instructions is included in the official GitHub Security Advisory, demonstrating the vulnerability using a simple API call and browser navigation (GitHub Security Advisory). The EPSS score is approximately 0.043% (14th percentile), indicating a currently low probability of active exploitation in the wild. No threat actor attribution or evidence of in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only low privileges (share creation permission) and victim interaction limited to opening a shared URL, making it relatively easy to weaponize (GitHub Advisory).

1. Reconnaissance: Identify a FileBrowser Quantum instance running a vulnerable version (≤ v1.2.1-stable or ≤ v1.3.0-beta) that is accessible over the network.
2. Obtain low-privileged access: Log in with any account that has share creation permission.
3. Craft malicious share: Send a POST /api/share API request with a malicious payload in the share metadata title field, e.g., title = <script>alert("xss")</script> (or a more sophisticated payload for session theft or data exfiltration).
4. Retrieve share URL: Note the resulting share URL in the format /public/share/<hash> returned by the API.
5. Deliver the link: Distribute the share URL to target victims (e.g., via email, chat, or by making the share publicly accessible). No further social engineering is required beyond getting the victim to open the link.
6. Payload execution: When any user (authenticated or unauthenticated) opens the share URL in a browser, the injected JavaScript executes in the application's origin, enabling session token theft, CSRF-like actions, or data exfiltration (GitHub Security Advisory).

• Network: Unusual POST /api/share requests containing HTML or JavaScript tags (e.g., <script>, <img onerror=, javascript:) in metadata fields such as title or description; outbound connections from the server to unexpected external hosts following share page visits.
• Logs: Web server access logs showing repeated visits to /public/share/<hash> endpoints from diverse IP addresses shortly after share creation; application logs recording share creation events with anomalous metadata content.
• File System: No direct file system artifacts expected for this XSS vulnerability, as the payload is stored in the application database rather than the file system.
• Application Data: Share records in the FileBrowser database containing HTML/JavaScript payloads in title or description fields (GitHub Security Advisory).

The vendor released patched versions on March 7, 2026: v1.2.2-stable and v1.3.1-beta, which address this vulnerability by replacing the unsafe text/template rendering with proper HTML-escaping mechanisms (v1.2.2-stable Release, v1.3.1-beta Release). Users should upgrade immediately to one of these patched versions. As a temporary measure where upgrading is not immediately possible, administrators should restrict share creation permissions to trusted users only and avoid exposing the FileBrowser instance to untrusted networks. No configuration-only workaround fully mitigates the vulnerability without patching.

The vulnerability received coverage from The Hacker Wire, which published an article specifically about the stored XSS in FileBrowser Quantum (The Hacker Wire). The advisory was also noted on Mastodon via The Hacker Wire's account. Vulnerability tracking platforms including VulDB and radar.offseq.com indexed the CVE shortly after disclosure. No significant vendor controversy or broader community debate has been observed.