CVE-2026-54685— FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
Possible ATT&CK Techniques 1AI
T1110.004 · Credential StuffingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| gtsteffaniak | filebrowser | < 1.3.2-beta | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-54685
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel
Source: CVE Program / CVE List V5
Vulnerability Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过时间差异性导致的信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
gtsteffaniak filebrowser 侧信道信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
gtsteffaniak filebrowser是gtsteffaniak的文件管理服务器。 gtsteffaniak filebrowser 1.3.2-beta之前版本存在侧信道信息泄露漏洞，该漏洞源于`/api/auth/login`认证端点未在恒定时间内执行，可能导致时间延迟差异，从而泄露用户信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| gtsteffaniak | filebrowser | < 1.3.2-beta | - |
II. Public POCs for CVE-2026-54685
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-54685
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-54685 (1)
Vendor Advisories for CVE-2026-54685 (1)
Vendor Pages for CVE-2026-54685 (1)
- 🔗 Release v1.3.2-beta · gtsteffaniak/filebrowser · GitHubx_refsource_MISC
Same Patch Batch · gtsteffaniak · 2026-07-20 · 3 CVEs total
| CVE-2026-54910 | 7.7 HIGH | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated us |
| CVE-2026-46410 | FileBrowser Quantum: unauthenticated user share share info |
IV. Related Vulnerabilities
Same product: filebrowser
- CVE-2026-54910
FileBrowser Quantum's path traversal issue in subtitle handl - CVE-2026-46410
FileBrowser Quantum: unauthenticated user share share info - CVE-2026-62685
File Browser: Colliding username normalization gives two use - CVE-2026-62843
File Browser: Archive builder turns backslash filenames into - CVE-2026-62683
File Browser: Trailing-slash delete leaves a stale public sh
Same vendor: gtsteffaniak
- CVE-2026-54910
FileBrowser Quantum's path traversal issue in subtitle handl - CVE-2026-46410
FileBrowser Quantum: unauthenticated user share share info - CVE-2026-48777
FileBrowser Quantum: Path Traversal in public share PATCH al - CVE-2026-44542
FileBrowser Quantum: Unauthenticated Path Traversal in Publi - CVE-2026-30934
FileBrowser Quantum: Stored XSS in public share page via uns
Same weakness: CWE-208
- CVE-2024-14041
ML-KEM (Kyber) decapsulation leaks private key information t - CVE-2026-13183
RadAsyncUpload Upload Metadata Timing Oracle Vulnerability i - CVE-2026-15432
Observable Timing Discrepancy in Tink-Java and Tink-Android - CVE-2026-6656
Crypt::Password versions through 0.28 for Perl are susceptib - CVE-2026-9537
Mojo::JWT versions before 1.02 for Perl verify HMAC signatur
V. Comments for CVE-2026-54685
No comments yet