A stored cross-site scripting vulnerability in FileBrowser Quantum allows unauthenticated or authenticated attackers to execute malicious scripts, potentially compromising user sessions.

The application fails to perform context-aware escaping on share metadata fields (title, description) when rendering them into HTML for public share pages. By utilizing the text/template package instead of html/template, the server permits the injection and subsequent execution of malicious scripts when a victim visits a crafted share URL.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of a victim's browser session. This can lead to unauthorized actions, the theft of session cookies, or the exfiltration of sensitive information, potentially resulting in full account compromise. Given the CVSS score of 8.9, this vulnerability presents a high risk to data confidentiality and integrity, necessitating prompt remediation.

Immediate Action: Upgrade to FileBrowser Quantum version 1.3.1-beta or 1.2.2-stable immediately to incorporate the required security fixes.

Proactive Monitoring: Review web server and application logs for suspicious activity, particularly requests directed at the /public/share/ endpoint that contain unusual metadata content.

Compensating Controls: Implement a strict Content Security Policy (CSP) to restrict the execution of unauthorized scripts and deploy a Web Application Firewall (WAF) to filter malicious XSS payloads from incoming HTTP requests.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

The high severity of this vulnerability, combined with the presence of a proof-of-concept, makes this a priority for security teams. Organizations utilizing FileBrowser Quantum must perform an immediate update to the patched versions to eliminate the cross-site scripting vector and protect user integrity.