What is the CVSS score of CVE-2026-54910?

CVE-2026-54910 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of FileBrowser Quantum are affected by CVE-2026-54910?

FileBrowser Quantum versions before 1.4.3-beta contain a path-traversal vulnerability in the /api/media/subtitles endpoint that allows any authenticated user to read arbitrary files, including SSH…. A patch is available.

Is there a public PoC exploit available for CVE-2026-54910?

Yes, a public proof-of-concept exploit is available for CVE-2026-54910. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-54910?

Within 24 hours, inventory all FileBrowser Quantum deployments in production and development environments and identify current versions. Within 7 days, upgrade all instances to version 1.4.3-beta or later to remediate the path-traversal vulnerability. Within 30 days, audit access logs for suspicious file-read patterns targeting /etc/passwd, SSH directories, and credential storage paths; rotate all SSH keys, database credentials, and JWT signing secrets that may have been exposed; and validate that user access to the file-browsing API remains limited to intended organizational users.

FileBrowser Quantum CVE-2026-54910

EUVD-2026-45957 HIGH

Path Traversal (CWE-22)

2026-07-20 GitHub_M

GHSA-vvp7-h4fj-m28w

Path Traversal Filebrowser Suse Gtsteffaniak

7.7

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.7 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Network-reachable endpoint (AV:N/AC:L), requires any authenticated account (PR:L), no UI; reads host files outside the app's storage root so scope changes (S:C) with pure confidentiality impact (C:H, I/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jul 20, 2026 - 17:02 EUVD

Source Code Evidence Fetched

Jul 20, 2026 - 15:02 vuln.today

Analysis Generated

Jul 20, 2026 - 15:02 vuln.today

CVE Published

Jul 20, 2026 - 14:20 cve.org

HIGH 7.7

DescriptionCVE.org

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint (GET /api/media/subtitles) accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed directly to idx.GetRealPath() without calling SanitizeUserPath(), allowing an attacker to escape the storage root and set parentDir to any directory on the host. No existing anchor file is required. The secondary vector is the name parameter: it is joined with parentDir via filepath.Join(parentDir, name) without stripping directory components, allowing traversal relative to any resolved parentDir. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including /etc/passwd, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.

AnalysisAI

Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's path and name query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.

Technical ContextAI

FileBrowser Quantum is a self-hosted, web-based file manager written in Go. The vulnerability is a classic CWE-22 improper limitation of a pathname to a restricted directory (path traversal) in the media subtitle handler (backend/http/media.go, subtitlesHandler). The root cause is twofold: the user-supplied path is passed directly into idx.GetRealPath() without the mandatory SanitizeUserPath() call, letting the attacker set parentDir to any host directory (no pre-existing anchor file required); and the name parameter is combined with parentDir using filepath.Join(parentDir, name) without stripping directory components (e.g., ../), enabling traversal relative to any resolved directory. The fix replaces the raw idx.GetRealPath() flow with files.FileInfoFaster() (which enforces access scope) plus a findSubtitleTrack() lookup and filepath.Base(track.Name), so only legitimately indexed subtitle tracks within the user's scope can be resolved. The affected code path is identified by CPE cpe:2.3:a:gtsteffaniak:filebrowser.

RemediationAI

Upgrade to FileBrowser Quantum 1.4.3-beta, which rewrites the subtitle and lyrics handlers to resolve paths through files.FileInfoFaster() with enforced access scope instead of the unsanitized idx.GetRealPath() call (Vendor-released patch: 1.4.3-beta; see GHSA-vvp7-h4fj-m28w and commit f3f4bbe80cb569d664174aea874d7bfa008c3b5a). If immediate upgrade is not possible, restrict who holds accounts on the instance since exploitation requires only a valid low-privilege login - revoke or disable untrusted user accounts, and place the application behind a reverse proxy that blocks or filters requests to GET /api/media/subtitles (side effect: subtitle/media playback of external subtitle tracks will break for legitimate users). Additionally, run the server process under a dedicated low-privilege OS account with a minimal filesystem view (e.g., a container or chroot with only the intended storage mounted) so that traversal cannot reach /etc/passwd, SSH keys, or credential files (trade-off: requires deployment changes and careful mount configuration). Rotate any secrets (JWT signing keys, DB credentials, SSH keys) that may have been exposed if compromise is suspected.