CVE-2026-54910 is a high-severity path traversal vulnerability affecting github.com/gtsteffaniak/filebrowser/backend versions < 0.0.0-20260608182036-f3f4bbe80cb5 in FileBrowser Quantum's subtitle handler, allowing any authenticated user to read arbitrary files via the 'path' parameter or by exploiting the 'name' parameter without sanitization. The primary vector involves passing the 'path' parameter directly to GetRealPath without calling SanitizeUserPath, enabling an attacker to escape the storage root and set parentDir to any directory on the host. The secondary vector involves joining the 'name' parameter with parentDir via filepath.Join(parentDir, name) without stripping directory components, allowing traversal relative to any resolved parentDir. This vulnerability enables arbitrary file read, scope bypass, credential exposure, and privilege escalation attacks. Any authenticated user can exploit this issue without requiring special permissions. The business impact includes reading sensitive files such as, SSH keys, database credentials, and JWT signing keys. The recommended fix involves applying SanitizeUserPath to the 'path' parameter and filepath.Base to the 'name' parameter.
We recommend you to update FileBrowser Quantum to version 0.0.0-20260608182036-f3f4bbe80cb5.[/subscribe_to_unlock_form]
CVE-2026-54910 is a high-severity path traversal vulnerability affecting github.com/gtsteffaniak/filebrowser/backend versions < 0.0.0-20260608182036-f3f4bbe80cb5 in FileBrowser Quantum's subtitle handler, allowing any authenticated user to read arbitrary files via the 'path' parameter or by exploiting the 'name' parameter without sanitization. The primary vector involves passing the 'path' parameter directly to GetRealPath without calling SanitizeUserPath, enabling an attacker to escape the storage root and set parentDir to any directory on the host. The secondary vector involves joining the 'name' parameter with parentDir via filepath.Join(parentDir, name) without stripping directory components, allowing traversal relative to any resolved parentDir. This vulnerability enables arbitrary file read, scope bypass, credential exposure, and privilege escalation attacks. Any authenticated user can exploit this issue without requiring special permissions. The business impact includes reading sensitive files such as, SSH keys, database credentials, and JWT signing keys. The recommended fix involves applying SanitizeUserPath to the 'path' parameter and filepath.Base to the 'name' parameter.
We recommend you to update FileBrowser Quantum to version 0.0.0-20260608182036-f3f4bbe80cb5.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]