CVE-2026-44542

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

Directory Traversal

github.com/gtsteffaniak/filebrowser is vulnerable to Directory Traversal. The vulnerability is due to improper sanitization of attacker-controlled path input before path validation, which allows an attacker to use traversal sequences to delete arbitrary files outside the intended shared directory...

CVE-2026-44542 FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

EUVD-2026-30344

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

CVE-2026-44542

CVE-2026-44542 affects FileBrowser Quantum. An attacker-controlled path input is joined with a trusted base path before sanitization, enabling path traversal (e.g., ../) to escape the shared directory. An unauthenticated attacker with a valid public share hash that has delete permissions can dele...

CVE-2026-44542 FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

FileBrowser Quantum 路径遍历漏洞

FileBrowser Quantum is a file manager developed by Graham Steffaniak. Versions prior to 1.3.1-stable and 1.3.9-beta contained a path traversal vulnerability. This vulnerability stemmed from the concatenation of trusted base paths before path cleaning, which could lead to directory traversal attac...

CVE-2026-44542: Improper Limitation of a Pathname to a Restricted Directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an...

FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Summary FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. Affected product - Product: FileBrowser Quantum gtsteffaniak/filebrowser - Verified...

GHSA-MMPX-JH39-WRV6 FileBrowser Vulnerable to Stored XSS via SVG File in Public Share (Missing CSP Header)

Summary FileBrowser Quantum serves inline SVG files without a Content-Security-Policy header, allowing embedded JavaScript in SVG files to execute when accessed via public share links. Verified on v1.3.0-stable. Affected product - Product: FileBrowser Quantum gtsteffaniak/filebrowser - Verified...

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion

Summary Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences e.g., ../ to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete...

CVE-2026-35585 vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-JVPW-637P-H3PW vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-JVPW-637P-H3PW vulnerabilities

Vulnerabilities for packages: filebrowser...

CVE-2026-35585 vulnerabilities

Vulnerabilities for packages: filebrowser...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: neuvector-scanner, rabbitmq-messaging-topology-operator, cert-manager-cmctl, podman, newrelic-infrastructure-agent, runc, helm, kpt, sonobuoy, gitness, libnvidia-container, hubble, rook, nats, buildah, kubescape, flux-source-controller, k3s, chezmoi, helm-set-status,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: chart-testing, cert-manager-cmctl, step-issuer, haproxy-ingress, nri-postgresql, kpt, rancher-system-upgrade-controller, gitness, amazon-cloudwatch-agent-operator, kubernetes-dashboard-auth, bank-vaults, flux-source-controller, k3s, argocd-image-updater, contour,...

CVE-2026-32289 vulnerabilities

Vulnerabilities for packages: grafana-mimir, neuvector-scanner, rabbitmq-messaging-topology-operator, cert-manager-cmctl, docker-credential-gcr, step-issuer, newrelic-infrastructure-agent, kwok, sftpgo, migrate, crossplane-provider-azure-sql, runc, helm, tetragon, terraform-provider-azuread, kpt,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: grafana-mimir, neuvector-scanner, rabbitmq-messaging-topology-operator, cert-manager-cmctl, docker-credential-gcr, step-issuer, newrelic-infrastructure-agent, kwok, sftpgo, migrate, crossplane-provider-azure-sql, runc, helm, tetragon, terraform-provider-azuread, kpt,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: minio-fips, gatekeeper, gatekeeper-fips, kube-arangodb-fips, loki, aactl, licenseclassifier, chezmoi, libnvidia-container-fips, nats, rancher-helm, backup-restore-operator-fips, dive, syft, vault-env, juicefs, trivy, jaeger-fips, kuma, rook-fips,...