Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.7

FileBrowser Quantum lets logged-in users read any server file

CVE-2026-54910 · published 3 months ago
Summary

Versions of FileBrowser Quantum before 1.4.3‑beta allow any user with a valid login to request files outside the intended storage area. By manipulating the subtitle request parameters, an attacker can view sensitive files such as password files, SSH keys, or database credentials that the server can read. Upgrade to version 1.4.3‑beta or later to fix the issue.

What to do
  • Update gtsteffaniak github.com/gtsteffaniak/filebrowser/backend to version 0.0.0-20260608182036-f3f4bbe80cb5.
  • Update github.com gtsteffaniak to version 0.0.0-20260608182036-f3f4bbe80cb5.
Affected software
Ecosystem VendorProductAffected versions
– gtsteffaniak filebrowser < 1.4.3-beta
Go gtsteffaniak github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260608182036-f3f4bbe80cb5
Fix: upgrade to 0.0.0-20260608182036-f3f4bbe80cb5
go github.com gtsteffaniak < 0.0.0-20260608182036-f3f4bbe80cb5
Fix: upgrade to 0.0.0-20260608182036-f3f4bbe80cb5
Original advisory text
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-22Path Traversal
CWE-23Relative Path Traversal
Timeline
Published20 Jul 2026
Updated4 Nov 2026
First seen20 Jul 2026
Sources
CVE-2026-54910 · NVD
CVE-2026-54910 · MITRE
GHSA-vvp7-h4fj-m28w · OSV
CVE-2026-54910 · OSV
GHSA-vvp7-h4fj-m28w · GHSA
Track software like this
Free during beta