Path traversal in FileBrowser Quantum subtitle handler endpoint (CVE-2026-54910)

The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) in FileBrowser Quantum accepts two user-controlled query parameters, `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The `path` parameter bypasses the `SanitizeUserPath()` call applied by every other handler, allowing an attacker to set the resolved directory to any location on the host; the `name` parameter is then joined to that directory without stripping traversal components. Any authenticated user, regardless of role or permissions, can exploit either vector to read any UTF-8 text file accessible to the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Affected versions: - <= 1.3.3-stable - <= 1.4.2-beta We recommend updating to: 1.4.3-beta. CVSS 7.7 · our assessment: this_week Reference: https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w Details: https://vuln.today/cve/CVE-2026-54910