v1.5.6-stable

gtsteffaniak/filebrowserv1.5.6-stableSep 4, 2026by gtsteffaniak

AI Summary

This release addresses a security vulnerability in the public metadata API and fixes two bugs: one regarding share password persistence and another causing infinite loading spinners on the login page.

Key Highlights

Fixed security vulnerability (GHSA-55mw-cwg7-m8f5) where the public metadata API returned file content to anonymous visitors
Resolved issue where saving an existing share incorrectly cleared its password
Fixed infinite loading spinner on the root path and login page caused by CSP security hardening

Full Release Notes

## What's Changed

 **Security**:
 - [Moderate] public metadata api returns file content to anonymous share visitors, ignoring the share's download limit and file-viewer setting (GHSA-55mw-cwg7-m8f5) -- thanks @kta1kri

 **BugFixes**:
 - Saving an existing share clears its password, even with no changes made (#2898)
 - Fixed infinite loading spinner on `/` and `/login` after CSP security hardening (#2886, #2890)

**Full Changelog**: https://github.com/gtsteffaniak/filebrowser/compare/v1.5.5-stable...v1.5.6-stable