FileBrowser Quantum versions before 1.3.1-stable and 1.3.9-beta improperly handle path input by joining attacker-controlled paths with a trusted base path prior to sanitization. This allows traversal sequences such as '../' to escape the intended shared directory boundaries. An unauthenticated attacker possessing a valid public share hash with delete permissions can exploit this to delete arbitrary files within the share owner's configured storage scope, impacting the integrity and availability of files. The vulnerability affects the public/api/resources and public/api/resources/bulk endpoints. The issue is fixed in the specified patched versions.

The vulnerability allows unauthenticated attackers with a valid public share hash and delete permissions to delete arbitrary files outside the intended shared directory. This compromises file integrity and availability within the share owner's storage scope. There is no impact on confidentiality reported. The CVSS score of 9.1 reflects critical severity due to ease of exploitation (network, no privileges, no user interaction) and high impact on integrity and availability. No known exploits in the wild have been reported at this time.

This vulnerability is fixed in FileBrowser Quantum versions 1.3.1-stable and 1.3.9-beta. Users should upgrade to these or later versions to remediate the issue. Since the vendor advisory does not indicate any temporary mitigations or that the issue is already mitigated, upgrading is the recommended action. Patch status is confirmed by the version information in the description.