Gtsteffaniak
Monthly
Symlink-following read paths in FileBrowser Quantum serve files from outside a user's assigned scope: download, preview, media/subtitle, OnlyOffice and public-share handlers resolve links with filepath.EvalSymlinks and then open the resolved target without checking that it is still inside the source root. The unauthenticated worst case, reflected in the CVSS vector (PR:N, S:C, C:H), is a holder of a public share link reading any file the server process can reach through a symlink reachable in the shared directory; an authenticated user with download access achieves the same, including cross-tenant reads where scopes overlap. Exposure requires that a qualifying symlink already exists in the served tree - common with bind-mounted host directories in Docker deployments - and affects filebrowser versions before 1.5.2-stable and 2.0.0-beta through 2.0.1-beta, which are fixed by 1.5.2-stable and 2.0.1-beta. A public proof-of-concept walkthrough accompanies the GHSA advisory and was demonstrated live against 1.3.3-stable; there is no CISA KEV entry, so active exploitation is not confirmed.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allows holders of a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root by abusing the publicPatchHandler in backend/http/public.go. The flaw stems from filepath.Join collapsing ../ segments BEFORE the SanitizeUserPath check runs, an identical pattern to the previously patched DELETE endpoint (CVE-2026-44542). No public exploit identified at time of analysis, but the GHSA advisory documents the exact code path and the issue is rated CVSS 4.0 9.3 (Critical).
Username enumeration via authentication timing side-channel in FileBrowser Quantum's `/api/auth/login` endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.
FileBrowser Quantum versions prior to 1.1.3-stable and 1.2.6-beta expose a password bypass vulnerability in shared files, allowing unauthenticated recipients to download protected content by accessing the direct download link embedded in share details. An attacker possessing only the share link can retrieve files without providing the intended password, completely circumventing access controls. Public exploit code exists for this vulnerability, and patches are available in the patched versions.
Symlink-following read paths in FileBrowser Quantum serve files from outside a user's assigned scope: download, preview, media/subtitle, OnlyOffice and public-share handlers resolve links with filepath.EvalSymlinks and then open the resolved target without checking that it is still inside the source root. The unauthenticated worst case, reflected in the CVSS vector (PR:N, S:C, C:H), is a holder of a public share link reading any file the server process can reach through a symlink reachable in the shared directory; an authenticated user with download access achieves the same, including cross-tenant reads where scopes overlap. Exposure requires that a qualifying symlink already exists in the served tree - common with bind-mounted host directories in Docker deployments - and affects filebrowser versions before 1.5.2-stable and 2.0.0-beta through 2.0.1-beta, which are fixed by 1.5.2-stable and 2.0.1-beta. A public proof-of-concept walkthrough accompanies the GHSA advisory and was demonstrated live against 1.3.3-stable; there is no CISA KEV entry, so active exploitation is not confirmed.
Arbitrary file read in FileBrowser Quantum (gtsteffaniak/filebrowser) before 1.4.3-beta lets any authenticated user, regardless of role or permissions, exfiltrate sensitive host files via the GET /api/media/subtitles endpoint. The endpoint's `path` and `name` query parameters are used in filesystem operations without sanitization, yielding two independent path-traversal vectors that escape the storage root to read files such as /etc/passwd, SSH keys, database credentials, and JWT signing keys. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the fix is confirmed in commit f3f4bbe and released in 1.4.3-beta.
Path traversal in FileBrowser Quantum (gtsteffaniak fork) versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allows holders of a public share link with AllowModify=true to move, copy, or rename arbitrary files within the share owner's source root by abusing the publicPatchHandler in backend/http/public.go. The flaw stems from filepath.Join collapsing ../ segments BEFORE the SanitizeUserPath check runs, an identical pattern to the previously patched DELETE endpoint (CVE-2026-44542). No public exploit identified at time of analysis, but the GHSA advisory documents the exact code path and the issue is rated CVSS 4.0 9.3 (Critical).
Username enumeration via authentication timing side-channel in FileBrowser Quantum's `/api/auth/login` endpoint allows unauthenticated remote attackers to distinguish valid from invalid usernames by measuring response latency. Valid usernames trigger a bcrypt password hash comparison (~40-50 ms), while non-existent usernames return almost immediately (~1-4 ms), creating a statistically exploitable timing differential. A working proof-of-concept Python script was published in the GHSA advisory; the CVE is not in CISA KEV, so active exploitation is not confirmed at time of analysis.
FileBrowser Quantum versions prior to 1.1.3-stable and 1.2.6-beta expose a password bypass vulnerability in shared files, allowing unauthenticated recipients to download protected content by accessing the direct download link embedded in share details. An attacker possessing only the share link can retrieve files without providing the intended password, completely circumventing access controls. Public exploit code exists for this vulnerability, and patches are available in the patched versions.