CVE-2026-116682
Description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
How to fix
- github.com/gtsteffaniak/filebrowser/backend0.0.0-20260814233832-4126edeb07a0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/gtsteffaniak/filebrowser/backendGo | v < 0.0.0-20260814233832-4126edeb07a0 | 0.0.0-20260814233832-4126edeb07a0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.