PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-54685 gtsteffaniak CVE debrief

CVE-2026-54685 is a MEDIUM severity vulnerability in FileBrowser Quantum, a free, self-hosted, web-based file manager. The `/api/auth/login` authentication endpoint is vulnerable to a timing attack. When a non-existent username is supplied, the server returns a response quickly. However, when a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. This issue was patched in version 1.3.2-beta. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM.

Vendor
gtsteffaniak
Product
filebrowser
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-20
Original CVE updated
2026-07-22
Advisory published
2026-07-20
Advisory updated
2026-07-22

Who should care

Users of FileBrowser Quantum, especially those with publicly accessible instances, should be aware of this vulnerability and take steps to mitigate it. This includes updating to version 1.3.2-beta or later, implementing additional monitoring for authentication attempts, and considering the use of a Web Application Firewall (WAF) to detect and prevent exploitation attempts.

Technical summary

The `/api/auth/login` endpoint in FileBrowser Quantum does not execute in constant time, allowing an attacker to exploit this by sending login requests with different usernames and measuring the response times to determine if a username is valid. This issue can be used to enumerate valid usernames. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The issue was patched in version 1.3.2-beta.

Defensive priority

Medium

Recommended defensive actions

  • Update to version 1.3.2-beta or later
  • Implement additional monitoring for authentication attempts
  • Consider using a Web Application Firewall (WAF) to detect and prevent exploitation attempts
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-20T15:16:43.787Z and last modified on 2026-07-21T16:17:15.607Z. The NVD entry is currently in the 'Received' state. Evidence is limited, and defenders should verify the affected scope and vendor guidance. The vulnerability affects FileBrowser Quantum, a free, self-hosted, web-based file manager. The `/api/auth/login` authentication endpoint is vulnerable to a timing attack. This issue was patched in version 1.3.2-beta.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-54685 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-54685

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-54685 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-54685

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.