EUVD-2026-45957Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Network-reachable endpoint (AV:N/AC:L), requires any authenticated account (PR:L), no UI; reads host files outside the app's storage root so scope changes (S:C) with pure confidentiality impact (C:H, I/A:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the subtitlesHandler endpoint (GET /api/media/subtitles) accepts two user-controlled query parameters: path and name, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the path parameter: it is passed directly to idx.GetRealPath() without calling SanitizeUserPath(), allowing an attacker to escape the storage root and set parentDir to any directory on the host. No existing anchor file is required. The secondary vector is the name parameter: it is joined with parentDir via filepath.Join(parentDir, name) without stripping directory components, allowing traversal relative to any resolved parentDir. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including /etc/passwd, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.
AnalysisAI
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's path and name query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires a valid authenticated session on the FileBrowser Quantum instance (PR:L) - any user account works, regardless of assigned role or file permissions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) is internally consistent with the description: network-reachable, low complexity, requires low-privilege authentication (PR:L, so any logged-in user), no user interaction, changed scope because the flaw reads data outside the application's authorized storage root, and pure confidentiality impact (no integrity or availability effect). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privilege user who has been granted only a limited share on a shared FileBrowser Quantum instance logs in and sends a crafted GET /api/media/subtitles request with a `path` (or `name`) value containing directory-traversal sequences pointing outside the storage root. The server reads the targeted file and returns its contents, letting the attacker retrieve /etc/passwd, the JWT signing key, or database credentials and pivot to broader compromise. … |
| Remediation | Upgrade to FileBrowser Quantum 1.4.3-beta, which rewrites the subtitle and lyrics handlers to resolve paths through files.FileInfoFaster() with enforced access scope instead of the unsanitized idx.GetRealPath() call (Vendor-released patch: 1.4.3-beta; see GHSA-vvp7-h4fj-m28w and commit f3f4bbe80cb569d664174aea874d7bfa008c3b5a). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all FileBrowser Quantum deployments in production and development environments and identify current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Filebrowser versions prior to 2.57.1 allow authenticated users to reset passwords without verifying the current password
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta all
Filebrowser versions up to 2.55.0 contains a vulnerability that allows attackers to enumerate valid usernames by measuri
Pre-authentication remote code execution in File Browser before 2.63.6 lets unauthenticated attackers run arbitrary OS c
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today