CVE-2026-48777 Details
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.
A path traversal vulnerability has been identified in FileBrowser Quantum versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta. The issue arises in the publicPatchHandler of backend/http/public.go, where user-controlled fromPath and toPath fields are joined with the trusted share path before undergoing proper sanitization. This flaw allows users to move, copy, or rename files outside the intended shared directory. Exploitation requires a public share link with AllowModify=true.
Users can update to FileBrowser Quantum versions 1.3.3-stable or 1.4.2-beta, both of which include the necessary fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 16, 2026CISA-ADP
Assessed Jun 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.3.3-stable | [email protected] | Release NotesVendor |
| https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.2-beta | [email protected] | Release NotesVendor |
| https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-qqqm-5547-774x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FileBrowser Quantum | <= 1.3.2-stable (semver) <= 1.4.1-beta (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 16, 2026 | New CVE Received | [email protected] |