CVE-2026-116682highCWE-22CWE-59

CVE-2026-116682: high-severity vulnerability in gtsteffaniak filebrowser

FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Published · Updated

Follow this CVE+ Monitor filebrowser+ Monitor github.com/gtsteffaniak/filebrowser/backend

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.6epss 0.5%
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Affected products
gtsteffaniak · filebrowser
Related CVEs — gtsteffaniak filebrowser

In the same product, most dangerous first.

CVE-2026-30933HIGHFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoEPSS 0.6%CVE-2026-48777CRITICALFileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directoryEPSS 0.5%CVE-2026-44542CRITICALFileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File DeletionEPSS 0.5%CVE-2026-46410HIGHFileBrowser Quantum: unauthenticated user share share infoEPSS 0.4%CVE-2026-54910HIGHFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesEPSS 0.4%CVE-2026-30934HIGHFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)EPSS 0.4%