CVE-2026-116682
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go in FileBrowser Quantum resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink; an authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink.
Risk Assessment
An attacker can access server files outside the assigned scope, potentially leading to leakage of confidential data.
Recommendation
Update FileBrowser Quantum to version 1.5.2-stable or 2.0.1-beta and consider disabling FollowSymlinks if not required.
Other vulnerabilities in FileBrowser Quantum
See all- CVE-2026-48777Critical
FileBrowser Quantum versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta are vulnerable to Path Traversal. The issue occurs in publicPatchHandler, where user-controlled paths can be manipulated, allowing operations on files outside the shared directory.
- CVE-2026-44542Critical
FileBrowser Quantum prior to versions 1.3.1-stable and 1.3.9-beta has a vulnerability that allows an attacker to use attacker-controlled path input to escape the intended shared directory. As a result, an unauthenticated attacker with a valid public share hash and delete permissions can delete arbitrary files outside this directory.
- CVE-2026-54910High
FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.
- CVE-2026-54685Medium
Vulnerability in FileBrowser Quantum prior to version 1.3.2-beta. The `/api/auth/login` endpoint does not execute in constant time, allowing an attacker to distinguish existing users from non-existing ones based on response time (timing attack).
- CVE-2026-46410High
Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.
Original NVD description (English source)
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS