FileBrowser Quantum version v1.3.0-stable is vulnerable to stored cross-site scripting (XSS) via SVG files served through public share links without a Content-Security-Policy (CSP) header. This allows embedded JavaScript in SVG files to execute in the browser of anyone accessing the public share link with inline rendering enabled. The vulnerability can lead to session hijacking and phishing attacks without requiring authentication. A fix is available that adds a CSP header to block script execution in inline SVG files.