FileBrowser Quantum allowed an attacker to embed malicious scripts in shared metadata fields such as title or description. Because the server used the text/template Go package instead of the context‑aware html/template, these scripts were rendered directly into the HTML of the public share page. When a victim opened that page, the payload executed in the victim's browser, potentially leaking session cookies, defacing the site, or executing further malicious actions. This is a classic stored XSS flaw (CWE‑79) that compromises confidentiality, integrity, and availability of the affected sessions.

The vulnerability affects FileBrowser Quantum versions released before 1.3.1‑beta and before 1.2.2‑stable, including the 1.2.1 stable release and the 1.3.0 beta build. The vendor is gtsteffaniak. Attacks target the /public/share/<hash> endpoint which renders any user‑supplied metadata without escaping.

The flaw receives a CVSS score of 8.9, indicating high severity. The EPSS score is below 1 %, suggesting few attacks are currently observed, but the vulnerability is listed only in the vendor advisory and is not yet in the CISA KEV list. An attacker needs to create or modify a share with malicious metadata; once a user visits the public URL, the injected code executes. This requires no privileged access and can be carried out by anyone who can publish a share.