CVE-2026-116682 Details
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
A vulnerability in FileBrowser Quantum prior to versions 1.5.2-stable and 2.0.1-beta allows for arbitrary file reading outside the user's designated scope. This issue arises because the application follows symlinks to their real paths without verifying that the resolved target remains within the user's authorized directory. As a result, an authenticated user with download access can access files beyond their assigned scope. Additionally, this vulnerability can be exploited by anyone with a public share link to a directory containing a symlink pointing outside the scope, bypassing authentication altogether.
Users can update to FileBrowser Quantum versions 1.5.2-stable or 2.0.1-beta, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj | CISA-ADP | AdvisoryBundleRemedyVendor |
| https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67 | [email protected] | Source CodeVendor |
| https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38 | [email protected] | Source CodeVendor |
| https://github.com/gtsteffaniak/filebrowser/pull/2795 | [email protected] | Issue TrackingVendor |
| https://github.com/gtsteffaniak/filebrowser/pull/2800 | [email protected] | Source CodeVendor |
| https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable | [email protected] | Release NotesVendor |
| https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta | [email protected] | Release NotesVendor |
| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileBrowser Quantum | <= 1.5.1-stable (semver) <= 2.0.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |