{"id":"GHSA-qqqm-5547-774x","revision":null,"records":[{"revision":"08fd99218552478a9c4b7e367ce0041a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-48777","aliases":[],"title":"FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory","description":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.","state":0,"publishedAt":"2026-06-16T18:40:06.121+00:00","modifiedAt":"2026-06-17T14:45:51.66+00:00","affected":[{"ecosystem":"Vendor product","name":"filebrowser","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gtsteffaniak\",\n                    \"product\": \"filebrowser\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.3.3-stable\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.4.0-beta, < 1.4.2-beta\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x","https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.3-stable","https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.2-beta"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-48777","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-48777","identifiers":["CVE-2026-48777"]},"retained":false,"historicalAffected":[]},{"revision":"353a763580ec4691878614f94d60af8c","observedAt":"2026-11-07T11:30:37.641+00:00","statement":{"source":"euvd","id":"EUVD-2026-37207","aliases":["CVE-2026-48777","GHSA-qqqm-5547-774x"],"title":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-control…","description":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":9.3,"severity":null}],"references":["https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x","https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.3-stable","https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.2-beta"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-37207","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 16, 2026, 6:40:06 PM","dateUpdated":"Jun 17, 2026, 2:45:51 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-37207","identifiers":["EUVD-2026-37207","CVE-2026-48777","GHSA-qqqm-5547-774x"]},"retained":false,"historicalAffected":[]},{"revision":"5577c7e336f14e79a6bd6be8def82acd","observedAt":"2026-10-27T13:11:53.172+00:00","statement":{"source":"nvd","id":"CVE-2026-48777","aliases":[],"title":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-control…","description":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.","state":0,"publishedAt":"2026-06-16T20:16:46.583+00:00","modifiedAt":"2026-10-25T23:10:00.167+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.3-stable","https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.2-beta","https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48777","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-06-16T20:16:46.583","lastModified":"2026-10-25T23:10:00.167"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-48777","identifiers":["CVE-2026-48777"]},"retained":false,"historicalAffected":[]},{"revision":"e7dd16727f23481b9c207f8b30f1347d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-qqqm-5547-774x","aliases":["CVE-2026-48777","GO-2026-5591"],"title":"FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory","description":"## Summary\n\n`publicPatchHandler` in `backend/http/public.go` joins user-controlled `fromPath` and `toPath` body fields with the trusted `d.share.Path` BEFORE the downstream sanitizer runs. Because `filepath.Join` collapses `..` segments during the join, the sanitizer in `resourcePatchHandler` never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated.\n\nA public share link with `AllowModify=true` is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root.\n\nVerified on commit 869b640 (HEAD of `main` as of 2026-05-07).\n\n## Details\n\nIn `backend/http/public.go` the public PATCH handler accepts a JSON body with `items[].fromPath` and `items[].toPath` from the client, then prepends the share path before delegating to `resourcePatchHandler`:\n\n```go\n// backend/http/public.go (publicPatchHandler)\nfor i := range req.Items {\n    req.Items[i].FromSource = sourceName\n    req.Items[i].FromPath   = utils.JoinPathAsUnix(d.share.Path, req.Items[i].FromPath) // line 372\n    req.Items[i].ToSource   = sourceName\n    req.Items[i].ToPath     = utils.JoinPathAsUnix(d.share.Path, req.Items[i].ToPath)   // line 374\n}\nd.Data = req\nstatus, err := resourcePatchHandler(w, r, d)\n```\n\n`utils.JoinPathAsUnix` is a thin wrapper around `filepath.Join`, which\ncalls `filepath.Clean` and resolves `..` segments. By the time the\njoined path reaches `resourcePatchHandler`, every `..` from the body\nhas been collapsed:\n\n```go\n// backend/http/resource.go (resourcePatchHandler)\ncleanFromPath, err := utils.SanitizeUserPath(item.FromPath) // line 794\n// ...\ncleanToPath, err  := utils.SanitizeUserPath(item.ToPath)    // line 800\n```\n\n`SanitizeUserPath` (in `backend/common/utils/file.go`) checks for `..` segments after `filepath.Clean`. Since the join already cleaned the path, no `..` segment remains, the sanitizer returns success, and the move/copy/rename proceeds on the escaped target.\n\nThe share owner's user is substituted as the acting user for permission checks (`d.user = shareCreatedByUser`), so the access-control layer treats the request as if the share owner performed it. In a default configuration with no explicit access rules and `DenyByDefault=false`, `Access.Permitted` returns true for any path within the source, and the only remaining boundary is the source root itself (`idx.Path` in `Index.GetRealPath`).\n\nThe fix that landed for CVE-2026-44542 / GHSA-fwj3-42wh-8673 moved the sanitizer before the join in `resourceBulkDeleteHandler` (`backend/http/resource.go:274`) and in `withHashFileHelper` (`backend/http/middleware.go:57`). The PATCH variant in `public.go` follows the opposite order (join first, sanitize later) and was not updated.\n\nFor comparison, the same file's `publicPutHandler` uses the safe order:\n\n```go\n// backend/http/public.go (publicPutHandler) -- safe order\ncleanPath, err := utils.SanitizeUserPath(path)         // sanitize FIRST\nif err != nil { return http.StatusBadRequest, err }\nresolvedPath := utils.JoinPathAsUnix(d.share.Path, cleanPath) // then join\n```\n\n## PoC\n\nThe bug reproduces deterministically with the project's own helpers, without needing the full server. The Go program below uses verbatim copies of `SanitizeUserPath` (from `backend/common/utils/file.go`) and `JoinPathAsUnix` (from `backend/common/utils/main.go`) and replays the exact sequence executed for one item in `publicPatchHandler` followed by `resourcePatchHandler`.\n\n```go\npackage main\n\nimport (\n    \"fmt\"\n    \"path/filepath\"\n    \"runtime\"\n    \"strings\"\n)\n\n// Verbatim from backend/common/utils/file.go\nfunc SanitizeUserPath(userPath string) (string, error) {\n    clean := filepath.Clean(userPath)\n    for _, segment := range strings.Split(clean, string(filepath.Separator)) {\n        if segment == \"..\" {\n            return \"\", fmt.Errorf(\"invalid path: path traversal detected\")\n        }\n    }\n    if clean == \".\" {\n        return \"\", fmt.Errorf(\"invalid path: path must standard index path\")\n    }\n    return clean, nil\n}\n\n// Verbatim from backend/common/utils/main.go\nfunc JoinPathAsUnix(parts ...string) string {\n    p := filepath.Join(parts...)\n    if runtime.GOOS == \"windows\" {\n        p = strings.ReplaceAll(p, \"\\\\\", \"/\")\n    }\n    return p\n}\n\nfunc main() {\n    sharePath := \"/users/alice/shared/\" // d.share.Path (server-controlled)\n    attackerInput := \"../../bob/secret.txt\"\n\n    // publicPatchHandler line 372: join BEFORE sanitize\n    joined := JoinPathAsUnix(sharePath, attackerInput)\n\n    // resourcePatchHandler line 794: sanitize the already-joined path\n    sanitized, err := SanitizeUserPath(joined)\n\n    fmt.Printf(\"attacker input: %q\\n\", attackerInput)\n    fmt.Printf(\"after join:     %q\\n\", joined)\n    fmt.Printf(\"sanitizer err:  %v\\n\", err)\n    fmt.Printf(\"sanitized path: %q\\n\", sanitized)\n}\n```\n\nOutput:\n\n```\nattacker input: \"../../bob/secret.txt\"\nafter join:     \"/users/bob/secret.txt\"\nsanitizer err:  <nil>\nsanitized path: \"/users/bob/secret.txt\"\n```\n\nThe path `/users/bob/secret.txt` is outside the share root `/users/alice/shared/` and is the value passed to `Index.GetRealPath` which resolves to `<source-root>/users/bob/secret.txt`. The downstream move/copy/rename then targets that file. The same input is rejected by `SanitizeUserPath` if the order is reversed (sanitize-then-join), which is the order used by `publicPutHandler` and the post-fix bulk DELETE.\n\nEnd-to-end exploit request shape:\n\n```\nPATCH /public/api/resources?hash=<share-hash> HTTP/1.1\nContent-Type: application/json\n\n{\n  \"action\": \"rename\",\n  \"items\": [\n    {\n      \"fromSource\": \"default\",\n      \"fromPath\":   \"../../bob/secret.txt\",\n      \"toSource\":   \"default\",\n      \"toPath\":     \"stolen.txt\"\n    }\n  ]\n}\n```\n\nAfter the request, `stolen.txt` exists inside the shared directory and is downloadable through the same public share, exfiltrating the file that was outside the share's intended scope.\n\n## Impact\n\nAn unauthenticated attacker who possesses a public share link with `AllowModify=true` can move, copy, or rename any file inside the share owner's source root, escaping the share's intended directory. Two practical exploitation patterns:\n\n1. Read arbitrary files in the source root: rename a file from outside the shared directory to a location inside it, then download it through the share. This breaks confidentiality of any file the share owner can read.\n\n2. Tamper with arbitrary files in the source root: move an attacker-controlled file (uploaded into the share) over the top of a victim file. This breaks integrity of files the share owner can write to (configuration files, dotfiles, web roots if the source includes them).\n\nScope is bounded by the source root rather than the shared directory, which is the same boundary class as CVE-2026-44542 (GHSA-fwj3-42wh-8673, CVSS 9.1). The remediation pattern is the same: sanitize first, then join. The fix is a one-spot change in `publicPatchHandler` to call `SanitizeUserPath` on `req.Items[i].FromPath` and `req.Items[i].ToPath` before the two `JoinPathAsUnix(d.share.Path, ...)` calls.","state":0,"publishedAt":"2026-05-22T17:26:25+00:00","modifiedAt":"2026-06-25T23:11:33.5206258+00:00","affected":[{"ecosystem":"Go","name":"github.com/gtsteffaniak/filebrowser/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260518193514-28e9b81e438e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x","https://github.com/gtsteffaniak/filebrowser"],"sourceUrl":"https://github.com/advisories/GHSA-qqqm-5547-774x","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-qqqm-5547-774x","identifiers":["GHSA-qqqm-5547-774x","CVE-2026-48777","GO-2026-5591"]},"retained":false,"historicalAffected":[]},{"revision":"4f87b217a36b48c6b0fe7aac2efc0f5f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5591","aliases":["CVE-2026-48777","GHSA-qqqm-5547-774x"],"title":"FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory in github.com/gtsteffaniak/filebrowser/backend","description":"FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory in github.com/gtsteffaniak/filebrowser/backend","state":0,"publishedAt":"2026-06-25T22:34:34+00:00","modifiedAt":"2026-06-25T23:01:24.1482411+00:00","affected":[{"ecosystem":"Go","name":"github.com/gtsteffaniak/filebrowser/backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.0.0-20260518193514-28e9b81e438e"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5591","license":"OSV · upstream source license applies","key":"osv:GO-2026-5591","identifiers":["GO-2026-5591","CVE-2026-48777","GHSA-qqqm-5547-774x"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:46.9707302+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.9707321+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-1766179264875bb4621a23ce4c6bcebec63fb794a16e35c2f5592f4ee300ee2e","complete":true,"records":420944,"lastAttemptAt":"2026-11-07T20:52:46.1142943+00:00","lastSuccessAt":"2026-11-07T20:52:46.0341312+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.1142943+00:00","snapshotPublishedAt":"2026-11-07T20:26:36+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbfb00168958467aaa6015d5230faa08","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T21:04:54.6100336+00:00","lastSuccessAt":"2026-11-07T21:04:54.606+00:00","error":null,"lastVerifiedAt":"2026-11-07T21:04:54.606+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T20:52:46.7845564+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T20:52:46.7845564+00:00","lastSuccessAt":"2026-11-07T20:52:47.1482288+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:47.1482303+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b9464f9c589b4886928e7045b5ad1e11","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T20:52:54.6850231+00:00","lastSuccessAt":"2026-11-07T20:52:54.68+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:54.68+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T20:52:46.6024506+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.6024506+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T20:52:46.3552169+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.3552169+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T20:52:46.7261257+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.7261257+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T20:52:46.4923243+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T20:52:46.4923243+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}