CVE-2026-44542
CriticalSummary
FileBrowser Quantum prior to versions 1.3.1-stable and 1.3.9-beta has a vulnerability that allows an attacker to use attacker-controlled path input to escape the intended shared directory. As a result, an unauthenticated attacker with a valid public share hash and delete permissions can delete arbitrary files outside this directory.
Risk Assessment
The organization is at risk of unauthorized file deletion, which may lead to data loss and disruption of operations. Specifically, an attacker could delete files that are critical to system functionality.
Recommendation
It is recommended to upgrade to version 1.3.1-stable or 1.3.9-beta to mitigate this vulnerability. Additionally, conducting an audit of permissions for public shares is advisable to minimize the risk of unauthorized access.
Other vulnerabilities in FileBrowser Quantum
See all- CVE-2026-48777Critical
FileBrowser Quantum versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta are vulnerable to Path Traversal. The issue occurs in publicPatchHandler, where user-controlled paths can be manipulated, allowing operations on files outside the shared directory.
- CVE-2026-54910High
FileBrowser Quantum before version 1.4.3-beta contains two path traversal vulnerabilities in the /api/media/subtitles endpoint. The 'path' and 'name' parameters are not properly sanitized, allowing any authenticated user to read any text file on the server, including /etc/passwd, SSH keys, and credentials.
- CVE-2026-54685Medium
Vulnerability in FileBrowser Quantum prior to version 1.3.2-beta. The `/api/auth/login` endpoint does not execute in constant time, allowing an attacker to distinguish existing users from non-existing ones based on response time (timing attack).
- CVE-2026-46410High
Vulnerability in FileBrowser Quantum prior to versions 1.3.2-stable and 1.4.1-beta may leak sensitive information such as source and path. Fixed in versions 1.3.2-stable and 1.4.1-beta.
Original NVD description (English source)
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS