CVE-2026-25890-FileBrowser-Access-Control-Bypass

CVE-2026-25890 - FileBrowser Access Control Bypass Unauthenticated users cannot exploit this — requires valid low-privileged credentials that are restricted from the target path. Path-based authorization bypass in FileBrowser ≤ v2.57.0 using multiple leading slashes //private instead of /private ...

CVE-2026-125659

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on...

CVE-2026-125659

The eMudhra emBridge software contains an information disclosure vulnerability due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without validating the requester's authority. An unauthenticated attac...

EUVD-2026-125272

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on...

CVE-2026-125659 Information Disclosure Vulnerability in eMudhra emBridge

This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on...

PT-2026-146804

Name of the Vulnerable Software and Affected Versions eMudhra emBridge affected versions not specified Description Missing authorization checks in the FileBrowser API endpoints allow an unauthenticated attacker on the same local area network to perform file system enumeration. The endpoints execu...

CVE-2013-6987

CVE-2013-6987 Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager DSM before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. dot dot Usage: python example: list filesystem python filelist.py...

CVE-2021-46398

CVE-2021-46398 - Lalie ARNOUD, Gaspard ANDRIEU In this repository, you will find a proof of concept of the exploitation of the CVE-2021-46398 flaw through a docker compose, as well as an analysis of the impacts of this flaw on information systems. Exploit Title: FileBrowser 2.17.2 - Cross Site...

FileBrowser: Symlink Following Escapes User Scope Allowing Arbitrary File Read Outside The Served Directory

Summary File read paths resolve symbolic links with "filepath.EvalSymlinks" and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

GHSA-MGQF-5MF5-PRFJ FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

CVE-2026-116682

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682

FileBrowser Quantum , a web-based file manager, is vulnerable to an arbitrary file read vulnerability in versions prior to 1.5.2-stable and 2.0.1-beta . The root cause is located in backend/pkg/indexing/indexingFiles.go, where the application resolves symbolic links using GetRealPath without veri...

EUVD-2026-111279

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682: Improper Limitation of a Pathname to a Restricted Directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

Graham Steffaniak filebrowser path traversal vulnerability

A security vulnerability exists in Graham Steffaniak FileBrowser versions prior to 1.5.2-stable and from 2.0.0-beta up to 2.0.1-beta. This vulnerability arises because file reading processes fail to verify that the resolved target of symbolic links lies within the source root directory and is...