FileBrowser Quantum before versions 1.3.1-stable and 1.3.9-beta improperly limits pathname traversal due to joining attacker-controlled path input with a trusted base path before sanitization. This allows traversal sequences like '../' to escape the shared directory boundary. An unauthenticated attacker possessing a valid public share hash with delete permissions can exploit this to delete arbitrary files within the share owner's configured storage scope via the public/api/resources and public/api/resources/bulk endpoints. The issue is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

The vulnerability enables unauthenticated attackers with a valid public share hash and delete permissions to delete arbitrary files outside the intended shared directory, potentially causing denial of service or data loss within the share owner's storage scope. There is no indication of confidentiality or integrity compromise beyond file deletion. No known exploits in the wild have been reported.

This vulnerability is fixed in FileBrowser Quantum versions 1.3.1-stable and 1.3.9-beta. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly stated in a vendor advisory but the description confirms the fix in these versions. No additional mitigations are specified.