FileBrowser Quantum EUVD-2026-37207

Exploitation requires three concrete conditions: (1) the target FileBrowser Quantum instance must have at least one public share whose AllowModify flag is set to true; (2) the attacker must possess (or guess/obtain) the share's URL hash - no account credentials are needed; (3) the deployment must use the default DenyByDefault=false access policy so the share owner's substituted permissions broadly permit operations on the source root. Limiting factors: instances exposing only read-only public shares are NOT vulnerable, and instances with explicit per-path access rules or DenyByDefault=true significantly reduce the exploitable file surface. No user interaction by the victim is required, and the attack works against default configurations whenever a modifiable public share exists.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H scores 9.3 (Critical) and accurately reflects that exploitation requires only network reachability to a share link - no authentication, no user interaction, and low complexity. However, PR:N is conditional on a real-world precondition not captured in the vector: the target share must have been created with AllowModify=true. EPSS and CISA KEV status are not provided in the input, and no public PoC is referenced; the GHSA advisory provides enough code detail that a working exploit is trivial to construct. The integrity impact (VI:H) is the dominant risk - attackers can rename/move/copy arbitrary files within the owner's source root, enabling data destruction, file substitution, or privilege escalation via overwriting trusted files. Confidentiality is rated VC:H in the vector, though the primary primitive is file relocation rather than direct read; this is a defensible upgrade because moves into a publicly-readable share location effectively expose contents. Realistic priority: high for any deployment using public modifiable shares; low for deployments that never enable AllowModify.

An attacker obtains or guesses a public share link for a FileBrowser Quantum instance where the owner enabled AllowModify=true (a common setting for collaborative shares). The attacker sends an HTTP PATCH to the public share endpoint with a JSON body containing items[].fromPath like '../../etc/secret.conf' and items[].toPath pointing inside the shared directory, causing filepath.Join to collapse the traversal and the server to move the owner's sensitive file into the publicly-readable share - exposing it for download or destroying its original location. No PoC is published in the references, but the GHSA advisory contains line-level code analysis sufficient to construct one in minutes.