EUVD-2026-37207
GHSA-qqqm-5547-774x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable public share endpoint, no auth required when AllowModify share exists (PR:N), arbitrary file move/copy yields high integrity and effective confidentiality impact; no direct availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.
AnalysisAI
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allows holders of a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root by abusing the publicPatchHandler in backend/http/public.go. The flaw stems from filepath.Join collapsing ../ segments BEFORE the SanitizeUserPath check runs, an identical pattern to the previously patched DELETE endpoint (CVE-2026-44542). No public exploit identified at time of analysis, but the GHSA advisory documents the exact code path and the issue is rated CVSS 4.0 9.3 (Critical).
Technical ContextAI
FileBrowser Quantum is a self-hosted, web-based file manager written in Go (identified by CPE cpe:2.3:a:gtsteffaniak:filebrowser). The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). In backend/http/public.go (lines 372/374), the publicPatchHandler uses utils.JoinPathAsUnix - a thin wrapper around Go's filepath.Join - to prepend the trusted d.share.Path to user-supplied fromPath/toPath fields. Because filepath.Join implicitly calls filepath.Clean, any ../ traversal segments are normalized away during the join. By the time resourcePatchHandler invokes utils.SanitizeUserPath (backend/common/utils/file.go), the sanitizer only sees a 'clean' path with no ../ tokens and approves it. Because the share owner is substituted as the acting principal (d.user = shareCreatedByUser), the permission layer also greenlights the operation across the owner's entire source root when DenyByDefault=false (the default).
RemediationAI
Vendor-released patch: upgrade to 1.3.3-stable (https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.3-stable) or 1.4.2-beta (https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.2-beta), which sanitize fromPath/toPath before joining with the share root. If immediate upgrade is not possible, the most effective compensating control is to disable AllowModify on all public shares (revoke or recreate links as read-only), which eliminates the exploit precondition at the cost of removing legitimate write-via-share functionality. As a defense-in-depth measure, set DenyByDefault=true so the share owner's permission layer rejects paths outside the share root even if the sanitizer is bypassed; this may break workflows that rely on implicit broad access. Network-level mitigations such as restricting the public share endpoint behind authentication (reverse proxy basicauth or VPN) also remove anonymous reachability but defeat the purpose of public sharing. Reference the full advisory at https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today