CVE-2026-54910
HighCVSS 7.7Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.
Risk Assessment
An attacker can access sensitive system and application files, leading to exposure of credentials, private keys, and other secrets.
Recommendation
Update FileBrowser Quantum to version 1.4.3-beta or later. Restrict access to the /api/media/subtitles endpoint to trusted users only.
Other vulnerabilities in FileBrowser Quantum
See all- CVE-2026-48777Critical
FileBrowser Quantum versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta are vulnerable to Path Traversal. The issue occurs in publicPatchHandler, where user-controlled paths can be manipulated, allowing operations on files outside the shared directory.
- CVE-2026-44542Critical
FileBrowser Quantum prior to versions 1.3.1-stable and 1.3.9-beta has a vulnerability that allows an attacker to use attacker-controlled path input to escape the intended shared directory. As a result, an unauthenticated attacker with a valid public share hash and delete permissions can delete arbitrary files outside this directory.
- CVE-2026-116682High
Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go in FileBrowser Quantum resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink; an authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink.
- CVE-2026-54685Medium
Vulnerability in FileBrowser Quantum prior to version 1.3.2-beta. The `/api/auth/login` endpoint does not execute in constant time, allowing an attacker to distinguish existing users from non-existing ones based on response time (timing attack).
- CVE-2026-46410High
Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.
Original NVD description (English source)
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS