Directory Traversal

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Directory Traversal through the RemoveAll process during upload failure-cleanup. An attacker can delete files outside their authorized directory by leveraging a symlink...

GO-2026-5383 FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser

FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion in github.com/gtsteffaniak/filebrowser...

GO-2026-5089 FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser

FileBrowser Quantum: unauthenticated user share share info in github.com/gtsteffaniak/filebrowser...

GO-2026-5096 File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path in github.com/filebrowser/filebrowser...

GO-2026-5150 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser

File Browser has an access rule bypass via HasPrefix without trailing separator in path matching in github.com/filebrowser/filebrowser...

GO-2026-5156 File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser

File Browser is vulnerable to Stored Cross-site Scripting via crafted EPUB file in github.com/filebrowser/filebrowser...

GO-2026-5055 File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser

File Browser: Symlink following lets scoped users read, overwrite, and share files outside their filebrowser scope in github.com/filebrowser/filebrowser...

CVE-2026-48777

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted...

CVE-2026-48777 FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted...

CVE-2026-48777 FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted...

CVE-2026-48777

CVE-2026-48777 — FileBrowser Quantum has a path-traversal in the public share PATCH endpoint. Versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta allow an attacker with a public share link that has AllowModify=true to move, copy, or rename files outside the share root by abusing publicPatc...

CVE-2026-48777 FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted...

Incomplete List of Disallowed Inputs

Overview github.com/filebrowser/filebrowser/http is a Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs. via the ParseCommand process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into allowed command input,...

Incomplete List of Disallowed Inputs

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs. via the ParseCommand process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into...

Symlink Attack

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Symlink Attack inadequate validation of symlink targets in the file access process. An attacker can access or modify files outside of the intended user scope by creating ...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack inadequate validation of symlink targets in the file access process. An attacker can access or modify files outside of the intended user scope by creating or leveraging symbolic links that point to locations beyond the...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremely large password values during authentication requests. Remediatio...

Improper Validation of Specified Quantity in Input

Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremel...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via the api/login process. An attacker can exhaust system resources and cause service disruption by submitting extremely large password values during authentication requests. Remediatio...

File Browser: Improper Access Control Occurs via Pre-Created Public Share for a Non-existent Path

Summary This is similar vulnrability of CVE-2026-0035, which was fixed in Android MediaProvider with high severity. In the original Java issue, MediaStore.createWriteRequest accepted attacker-controlled URIs and created a future grant even when the referenced media item did not exist yet. The...