CVE-2026-44542 FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

CVE-2026-44542: Improper Limitation of a Pathname to a Restricted Directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

FileBrowser Quantum path traversal vulnerability

FileBrowser Quantum is a file manager developed by Graham Steffaniak. Versions prior to 1.3.1-stable and 1.3.9-beta contained a path traversal vulnerability. This vulnerability stemmed from the concatenation of trusted base paths before path cleaning, which could lead to directory traversal attac...

GHSA-MMPX-JH39-WRV6 FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Summary FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. Affected product - Product: FileBrowser Quantum gtsteffaniak/filebrowser - Verified...

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Summary FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. Affected product - Product: FileBrowser Quantum gtsteffaniak/filebrowser - Verified...

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

Summary Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete...

PT-2026-41532

Summary FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. Affected product - Product: FileBrowser Quantum gtsteffaniak/filebrowser - Verified...

GHSA-JVPW-637P-H3PW vulnerabilities

Vulnerabilities for packages: filebrowser...

CVE-2026-35585 vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-JVPW-637P-H3PW vulnerabilities

Vulnerabilities for packages: filebrowser...

CVE-2026-35585 vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: terraform, rancher, gitaly, kaf, rancher-helm, rclone, helm-set-status, flux-helm-controller, filebrowser, malcontent, incert, openbao, redpanda, k8s-device-plugin, caddy, weaviate, falcoctl, scorecard, dive, pulumi-language-java, ingress-nginx-controller,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: terraform, docker-machine-driver-linode, kube-state-metrics, rancher, gitaly, kaf, step, net-kourier, step-issuer, rancher-helm, rclone, cert-manager-csi-driver, helm-set-status, lvm-driver, descheduler, flux-helm-controller, terraform-provider-time,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: git-sync, http-echo, actions-runner-controller, omnibump, helm-set-status, chisel, flux-helm-controller, kubernetes-csi-node-driver-registrar, redpanda, etcd, step-kms-plugin, redis-operator, contour, falcoctl, rqlite, dive, envoy-ratelimit, sftpgo-plugin-eventstore,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: terraform, docker-machine-driver-linode, kube-state-metrics, rancher, gitaly, kaf, step, net-kourier, step-issuer, rancher-helm, rclone, cert-manager-csi-driver, helm-set-status, lvm-driver, descheduler, flux-helm-controller, terraform-provider-time,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter, redpanda, rancher-agent, elastic-agent, envconsul-fips, cilium-envoy-fips, prometheus, pulumi-language-yaml, opa-envoy, prometheus-podman-exporter, gitlab-kas-fips, net-kourier, cerbos, task, gh, knative-operator, tkn-fips,...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: prometheus-elasticsearch-exporter, redpanda, rancher-agent, elastic-agent, envconsul-fips, cilium-envoy-fips, prometheus, pulumi-language-yaml, opa-envoy, prometheus-podman-exporter, gitlab-kas-fips, net-kourier, cerbos, task, gh, knative-operator, tkn-fips,...

Improper Privilege Management

Overview Affected versions of this package are vulnerable to Improper Privilege Management in the createUser process in auth/proxy.go when proxy authentication is enabled and default settings include non-empty commands. An attacker can gain unauthorized execution capabilities and access to...

CVE-2026-5709

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...

EUVD-2026-19550

Unsanitized input in the FileBrowser API in AWS Research and Engineering Studio RES version 2024.10 through 2025.12.01 might allow a remote authenticated actor to execute arbitrary commands on the cluster-manager EC2 instance via crafted input when using the FileBrowser functionality. To remediat...