Threat Intelligence Database

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.

FileBrowser Quantum versions prior to 1.3.2-stable and 1.4.1-beta contain a vulnerability that may leak sensitive information such as source code and file paths. This issue is identified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. Versions 1.3.2-stable and 1.4.1-beta address this vulnerability. No known workarounds are available.

filebrowser versions before 2.63.17 contain a vulnerability in the DeleteWithPathPrefix function where paths are not normalized before querying the share index. This allows authenticated users to leave stale public shares behind by deleting a shared directory with a trailing slash and then recreating it, exposing new contents through the dormant public share URL.