CVE-2026-116682highCWE-22CWE-59

CVE-2026-116682: fallo de gravedad alta en gtsteffaniak filebrowser

FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear filebrowser+ Monitorear github.com/gtsteffaniak/filebrowser/backend

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.6epss 0.5%
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Productos afectados
gtsteffaniak · filebrowser
CVEs relacionadas — gtsteffaniak filebrowser

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-30933HIGHFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoEPSS 0.6%CVE-2026-48777CRITICALFileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directoryEPSS 0.5%CVE-2026-44542CRITICALFileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File DeletionEPSS 0.5%CVE-2026-46410HIGHFileBrowser Quantum: unauthenticated user share share infoEPSS 0.4%CVE-2026-30934HIGHFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)EPSS 0.4%CVE-2026-54910HIGHFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesEPSS 0.4%