CVE-2026-44542
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk44th percentile - higher than 44% of all known CVEs
Summary
FileBrowser Quantum prior to versions 1.3.1-stable and 1.3.9-beta has a vulnerability that allows an attacker to use attacker-controlled path input to escape the intended shared directory. As a result, an unauthenticated attacker with a valid public share hash and delete permissions can delete arbitrary files outside this directory.
Risk Assessment
The organization is at risk of unauthorized file deletion, which may lead to data loss and disruption of operations. Specifically, an attacker could delete files that are critical to system functionality.
Recommendation
It is recommended to upgrade to version 1.3.1-stable or 1.3.9-beta to mitigate this vulnerability. Additionally, conducting an audit of permissions for public shares is advisable to minimize the risk of unauthorized access.
Other vulnerabilities in FileBrowser Quantum
See all- CVE-2026-48777Critical
FileBrowser Quantum versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta are vulnerable to Path Traversal. The issue occurs in publicPatchHandler, where user-controlled paths can be manipulated, allowing operations on files outside the shared directory.
- CVE-2026-116682High
Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go in FileBrowser Quantum resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink; an authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink.
- CVE-2026-54910High
FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.
- CVE-2026-54685Medium
Vulnerability in FileBrowser Quantum prior to version 1.3.2-beta. The `/api/auth/login` endpoint does not execute in constant time, allowing an attacker to distinguish existing users from non-existing ones based on response time (timing attack).
- CVE-2026-46410High
Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.
Original NVD description (English source)
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS