Nixpkgs security tracker

Dismissed

Permalink CVE-2026-54685

5.3 MEDIUM

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 6 days, 14 hours ago by @LeSuisse Activity log

Created suggestion 6 days, 15 hours ago
@LeSuisse ignored
3 packages
- python313Packages.filebrowser-safe
- python314Packages.filebrowser-safe
- filebrowser
6 days, 14 hours ago
@LeSuisse dismissed 6 days, 14 hours ago

FileBrowser Quantum has Username Enumeration via Authentication Timing Side-Channel

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.

References

https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-7789-65hx-f26w x_refsource_CONFIRM
https://github.com/gtsteffaniak/filebrowser/commit/af08800667b874620edc6f44c3e2e64fec7abd85 x_refsource_MISC
https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.2-beta x_refsource_MISC

Affected products

filebrowser

==< 1.3.2-beta

Matching in nixpkgs

pkgs.filebrowser-quantum

Access and manage your files from the web

nixos-unstable 1.4.0-stable
- nixpkgs-unstable 1.4.0-stable
- nixos-unstable-small 1.4.0-stable
nixos-26.05 1.4.0-stable
- nixos-26.05-small 1.4.0-stable
- nixpkgs-26.05-darwin 1.4.0-stable

Ignored packages (3)

pkgs.filebrowser

Web application for managing files and directories

nixos-unstable 2.63.15
- nixpkgs-unstable 2.63.15
- nixos-unstable-small 2.63.18
nixos-26.05 2.63.15
- nixos-26.05-small 2.63.18
- nixpkgs-26.05-darwin 2.63.15

pkgs.python313Packages.filebrowser-safe

Snapshot of django-filebrowser for the Mezzanine CMS

nixos-unstable 1.1.1
- nixpkgs-unstable 1.1.1
- nixos-unstable-small 1.1.1
nixos-26.05 1.1.1
- nixos-26.05-small 1.1.1
- nixpkgs-26.05-darwin 1.1.1

pkgs.python314Packages.filebrowser-safe