FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory

Summary File read paths resolve symbolic links with filepath.EvalSymlinks and then operate on the resolved target without re-checking that the target still lies inside the user's source/scope. A symlink located inside a user's accessible directory that points outside the scope for example to...

CVE-2026-116682

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

CVE-2026-116682

FileBrowser Quantum , a web-based file manager, is vulnerable to an arbitrary file read vulnerability in versions prior to 1.5.2-stable and 2.0.1-beta . The root cause is located in backend/pkg/indexing/indexingFiles.go, where the application resolves symbolic links using GetRealPath without veri...

CVE-2026-116682 FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...

PT-2026-127183

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user...