Which versions of Suse are affected by CVE-2026-46410?

FileBrowser Quantum contains an information disclosure vulnerability allowing anonymous users to access sensitive metadata including internal filesystem paths and source locations of shared items.. A patch is available.

How to fix or mitigate CVE-2026-46410?

Within 24 hours, inventory all FileBrowser Quantum deployments and identify which instances have anonymous sharing enabled or are accessible from untrusted networks. Within 7 days, apply the available vendor patch to all instances prioritizing production systems, then conduct functional testing to confirm shared file access operates correctly post-patch. Within 30 days, complete patching across all remaining instances and audit anonymous user scope configurations to ensure sensitive metadata access is properly restricted.

Suse CVE-2026-46410

Q: What is the CVSS score of CVE-2026-46410?

CVE-2026-46410 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-45952 HIGH

Information Exposure (CWE-200)

2026-05-19 https://github.com/gtsteffaniak/filebrowser

GHSA-3jmg-p96m-m328

Information Disclosure Suse

8.7

CVSS 4.0 · Vendor: https://github.com/gtsteffaniak/filebrowser

Severity by source

Vendor (https://github.com/gtsteffaniak/filebrowser) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

SUSE

HIGH

qualitative

Primary rating from Vendor (https://github.com/gtsteffaniak/filebrowser).

CVSS VectorVendor: https://github.com/gtsteffaniak/filebrowser

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jul 20, 2026 - 15:28 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 20, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.7 (HIGH)

Source Code Evidence Fetched

May 19, 2026 - 20:30 vuln.today

Analysis Generated

May 19, 2026 - 20:30 vuln.today

DescriptionCVE.org

Impact

Some sensitive info -- such as source and path can get exposed.

Patches

Update to the latest version

Workarounds

AnalysisAI

Information disclosure in FileBrowser Quantum (gtsteffaniak/filebrowser) allows an unauthenticated 'anonymous' user to view sensitive share metadata, including the underlying source and filesystem path of shared items. The flaw stems from default user scopes being applied to the anonymous account, exposing backend location details that should remain hidden. No public exploit or active exploitation is identified, and the EPSS score is low (0.05%), but the fix is labeled critical by the maintainer.

Same weakness CWE-200 – Information Exposure

View all

CVE-2024-24919 HIGH POC

8.6

CVE-2016-6415 HIGH POC

7.5

CVE-2013-7331 MEDIUM POC

6.5

CVE-2025-31125 MEDIUM POC

5.3

CVE-2025-11749 CRITICAL POC

9.8

CVE-2017-16894 HIGH POC

7.5

CVE-2017-11165 CRITICAL POC

9.8

CVE-2020-3259 HIGH

7.5

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Server 16.1	Affected
SUSE Linux Enterprise Server for SAP applications 16.1	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5	Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6	Affected
openSUSE Leap 15.5	Affected

CVE-2026-46410 vulnerability details – vuln.today

Back

Suse CVE-2026-46410

Severity by source

CVSS VectorVendor: https://github.com/gtsteffaniak/filebrowser

Lifecycle Timeline

DescriptionCVE.org

Impact

Patches

Workarounds

AnalysisAI

Same weakness CWE-200 – Information Exposure

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code