FileBrowser Quantum CVE-2026-54910

Requires a valid authenticated session on the FileBrowser Quantum instance (PR:L) - any user account works, regardless of assigned role or file permissions. The attacker sends a request to GET /api/media/subtitles and abuses either the path parameter (passed to idx.GetRealPath() without SanitizeUserPath(), so it can set parentDir to any host directory and requires no pre-existing anchor file) or the name parameter (joined via filepath.Join without stripping ../ components). The vulnerability is limited to reading files that are readable by the server process and to text/subtitle-readable content; it provides no write, integrity, or code-execution capability, and cannot be triggered without authentication. Affected only on versions prior to 1.4.3-beta.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) is internally consistent with the description: network-reachable, low complexity, requires low-privilege authentication (PR:L, so any logged-in user), no user interaction, changed scope because the flaw reads data outside the application's authorized storage root, and pure confidentiality impact (no integrity or availability effect). Real-world priority is elevated by the fact that ANY authenticated user, even one with no file permissions, can read host secrets - a meaningful privilege-boundary break in multi-user deployments. Tempering factors: exploitation requires a valid account (PR:L), so fully unauthenticated internet exposure is not in scope; no EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active or automated exploitation at this time. EPSS is not supplied and cannot be inferred. Net: a genuine High-priority secret-disclosure bug for any instance with untrusted or numerous user accounts, but not a wormable unauthenticated RCE.

A low-privilege user who has been granted only a limited share on a shared FileBrowser Quantum instance logs in and sends a crafted GET /api/media/subtitles request with a path (or name) value containing directory-traversal sequences pointing outside the storage root. The server reads the targeted file and returns its contents, letting the attacker retrieve /etc/passwd, the JWT signing key, or database credentials and pivot to broader compromise. No public POC is referenced in the provided data, but the vector is trivially reproducible given the described unsanitized parameters and CVSS AC:L.