CVE-2026-116682 in FileBrowser
Summary
by MITRE • 10/27/2026
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
FileBrowser Quantum operates as a self-hosted, web-based file management solution that allows users to organize, share, and manage files through a browser interface. The software provides various access mechanisms including authenticated user accounts with specific permissions and public sharing links for directories or individual files. These features are designed to facilitate easy collaboration while maintaining security boundaries around accessible content. However, the underlying implementation of how symbolic links are resolved within the file indexing subsystem introduces a critical path traversal vulnerability that undermines these intended security controls.
The core technical flaw resides in the backend package responsible for handling file indexing and reading operations, specifically within the logic defined in indexingFiles.go. When processing requests to read files, the application utilizes the GetRealPath function to resolve symbolic links into their actual physical paths on the server filesystem. This resolution process is intended to allow users to access targets of symlinks seamlessly. However, the implementation fails to perform a subsequent validation step after resolving the symlink target. It does not verify whether this resolved absolute path remains within the boundaries of the designated source root directory or falls inside the specific scope authorized for the requesting user or public share context. This omission creates a classic path traversal scenario where an attacker can manipulate symbolic link targets to point outside their permitted area.
The operational impact of this vulnerability is significant, as it allows unauthorized access to sensitive server-side data that should be strictly isolated from end users. For authenticated users who possess download permissions for a specific directory, the lack of boundary enforcement means they can construct or utilize existing symlinks within that directory to read files located anywhere on the filesystem accessible by the FileBrowser process user account. This effectively bypasses access control lists and permission settings configured at the application level. Furthermore, the vulnerability extends to unauthenticated scenarios involving public share links. If a shared directory contains a symbolic link pointing outside its scope, any individual with knowledge of that public URL can retrieve files from restricted areas without needing valid credentials or explicit authorization for those specific resources.
This type of flaw is categorized under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes vulnerabilities where software does not properly neutralize special elements within file paths. In the context of attack tactics, this vulnerability aligns with ATT&CK technique T1083: File and Directory Discovery, as it enables an adversary to enumerate and access files outside their intended scope. The ability to read arbitrary server-accessible files can lead to further exploitation vectors such as credential theft via configuration file exposure or intellectual property loss through unauthorized data exfiltration.
To mitigate this risk, organizations running affected versions of FileBrowser Quantum must upgrade immediately to version 1.5.2-stable or 2.0.1-beta and later releases where the path validation logic has been corrected. The fix ensures that after resolving a symbolic link, the application explicitly checks if the resulting absolute path is contained within the allowed root directory for that specific request context. Until an upgrade can be performed, administrators should audit their file structures to remove or restrict symlinks that point outside of designated directories and ensure that the underlying filesystem permissions are tightly controlled so that even if a traversal occurs, the operating system level denies access to sensitive files. Regular security audits focusing on symlink usage within web application document roots remain essential for maintaining robust defense-in-depth strategies against path traversal attacks.