Read the docs
TI-2026-36047 Aliases CVE-2026-48777GHSA-qqqm-5547-774x

FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

Priority HIGH 81CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0055 46th percentileScored 2026-11-07
Fix Fixed filebrowser (gtsteffaniak): 1.3.3-stable, 1.4.2-betagithub.com/gtsteffaniak/filebrowser/backend (Go): 0.0.0-20260518193514-28e9b81e438e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gtsteffaniakfilebrowserbefore 1.3.3-stable; 1.4.0-beta to before 1.4.2-beta1.3.3-stable, 1.4.2-betaPatch availableCNA
—github.com/gtsteffaniak/filebrowser/backend (Go)before 0.0.0-20260518193514-28e9b81e438e0.0.0-20260518193514-28e9b81e438ePatch availableGHSA-qqqm-5547-774x
  • filebrowser Vendorgtsteffaniak Affected before 1.3.3-stable; 1.4.0-beta to before 1.4.2-beta Fixed in 1.3.3-stable, 1.4.2-beta Patch available CNA
  • github.com/gtsteffaniak/filebrowser/backend (Go) Vendor— Affected before 0.0.0-20260518193514-28e9b81e438e Fixed in 0.0.0-20260518193514-28e9b81e438e Patch available GHSA-qqqm-5547-774x

Remediation

  • Fix · CNA filebrowser (gtsteffaniak) Fixed in 1.3.3-stable, 1.4.2-beta
  • Fix · GHSA-qqqm-5547-774x github.com/gtsteffaniak/filebrowser/backend (Go) Fixed in 0.0.0-20260518193514-28e9b81e438e Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48777
  2. 2026-10-03 Alias added: GHSA-qqqm-5547-774x

References

Other 4

  • TI-2026-32454 FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion CVSS 3.1CRITICAL 9.1
  • TI-2026-81497 Symlink following in FileBrowser Quantum exposes out-of-scope files CVSS 3.1HIGH 8.6
  • TI-2026-23759 FileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse) CVSS 3.1HIGH 8.9
  • TI-2026-23758 FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info CVSS 3.1HIGH 7.5
  • TI-2026-21997 FileBrowser Quantum: Password Protection Not Enforced on Shared File Links CVSS 4.0HIGH 7.1
  • TI-2026-39682 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files CVSS 3.1HIGH 7.7
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences