Which versions of FileBrowser Quantum are affected by CVE-2026-48777?

FileBrowser Quantum (gtsteffaniak fork) contains a critical path traversal vulnerability (CVE-2026-48777, CVSS 9.3) allowing unauthorized file manipulation through public share links with modify…. A patch is available.

How to fix or mitigate CVE-2026-48777?

Within 24 hours: Inventory all FileBrowser Quantum instances and identify those running versions prior to 1.3.2-stable; immediately disable AllowModify permissions on all public share links or suspend public sharing capability. Within 7 days: Implement compensating controls including network access restrictions, audit logging for file operations, and establish patch deployment procedures. Within 30 days: Deploy vendor-released patches to all affected instances once available and validation-tested.

FileBrowser Quantum CVE-2026-48777

Q: What is the CVSS score of CVE-2026-48777?

CVE-2026-48777 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-37207 CRITICAL

Path Traversal (CWE-22)

2026-06-16 GitHub_M

GHSA-qqqm-5547-774x

Path Traversal Filebrowser

9.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable public share endpoint, no auth required when AllowModify share exists (PR:N), arbitrary file move/copy yields high integrity and effective confidentiality impact; no direct availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 16, 2026 - 19:49 vuln.today

Analysis Generated

Jun 16, 2026 - 19:49 vuln.today

DescriptionCVE.org

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.

AnalysisAI

Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allows holders of a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root by abusing the publicPatchHandler in backend/http/public.go. The flaw stems from filepath.Join collapsing ../ segments BEFORE the SanitizeUserPath check runs, an identical pattern to the previously patched DELETE endpoint (CVE-2026-44542). No public exploit identified at time of analysis, but the GHSA advisory documents the exact code path and the issue is rated CVSS 4.0 9.3 (Critical).

Technical ContextAI

FileBrowser Quantum is a self-hosted, web-based file manager written in Go (identified by CPE cpe:2.3:a:gtsteffaniak:filebrowser). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In backend/http/public.go (lines 372/374), the publicPatchHandler uses utils.JoinPathAsUnix - a thin wrapper around Go's filepath.Join - to prepend the trusted d.share.Path to user-supplied fromPath/toPath fields. Because filepath.Join implicitly calls filepath.Clean, any ../ traversal segments are normalized away during the join. By the time resourcePatchHandler invokes utils.SanitizeUserPath (backend/common/utils/file.go), the sanitizer only sees a 'clean' path with no ../ tokens and approves it. Because the share owner is substituted as the acting principal (d.user = shareCreatedByUser), the permission layer also greenlights the operation across the owner's entire source root when DenyByDefault=false (the default).

RemediationAI

Vendor-released patch: upgrade to 1.3.3-stable (https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.3-stable) or 1.4.2-beta (https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.2-beta), which sanitize fromPath/toPath before joining with the share root. If immediate upgrade is not possible, the most effective compensating control is to disable AllowModify on all public shares (revoke or recreate links as read-only), which eliminates the exploit precondition at the cost of removing legitimate write-via-share functionality. As a defense-in-depth measure, set DenyByDefault=true so the share owner's permission layer rejects paths outside the share root even if the sanitizer is bypassed; this may break workflows that rely on implicit broad access. Network-level mitigations such as restricting the public share endpoint behind authentication (reverse proxy basicauth or VPN) also remove anonymous reachability but defeat the purpose of public sharing. Reference the full advisory at https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x.