CVE-2026-46410: falha de alta gravidade em gtsteffaniak filebrowser
FileBrowser Quantum: unauthenticated user share share info
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.4%
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
gtsteffaniak · filebrowserCVEs relacionadas — gtsteffaniak filebrowser
No mesmo produto, das mais perigosas para as menos.
CVE-2026-30933HIGHFileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/infoEPSS 0.6%CVE-2026-48777CRITICALFileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directoryEPSS 0.5%CVE-2026-116682HIGHFileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directoryEPSS 0.5%CVE-2026-44542CRITICALFileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File DeletionEPSS 0.5%CVE-2026-54910HIGHFileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary filesEPSS 0.4%CVE-2026-30934HIGHFileBrowser Quantum: Stored XSS in public share page via unsanitized share metadata (text/template misuse)EPSS 0.4%