CVE-2026-54910 Details

A path traversal vulnerability has been identified in FileBrowser Quantum versions prior to 1.4.3-beta. The issue resides in the 'subtitlesHandler' endpoint, specifically 'GET /api/media/subtitles', where two user-controlled query parameters, 'path' and 'name', are used in filesystem operations without proper sanitization. This oversight creates two independent path traversal vectors. The primary vector involves the 'path' parameter, which is passed directly to 'idx.GetRealPath()' without being sanitized, enabling an attacker to escape the storage root and manipulate the 'parentDir' variable to point to any directory on the host. The secondary vector involves the 'name' parameter, which is concatenated with 'parentDir' using 'filepath.Join' without removing directory components, allowing traversal relative to any resolved 'parentDir'. Any authenticated user can exploit these vectors to read any text file accessible by the server process, including sensitive files like '/etc/passwd', SSH keys, database credentials, and JWT signing keys.

Users are advised to update to FileBrowser Quantum version 1.4.3-beta, which addresses the vulnerability by sanitizing the 'path' parameter and stripping directory components from the 'name' parameter to prevent traversal.