{"id":"CVE-2026-54910","sourceIdentifier":"security-advisories@github.com","published":"2026-07-20T15:16:43.933","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required.  The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue."},{"lang":"es","value":"FileBrowser Quantum es un gestor de archivos gratuito, autoalojado y basado en web. Antes de la versión 1.4.3-beta, el endpoint “subtitlesHandler” (“GET /api/media/subtitles”) acepta dos parámetros de consulta controlados por el usuario: “path” y “name”, ambos utilizados en operaciones del sistema de archivos sin sanitización, creando dos vectores independientes de salto de ruta. El vector principal es el parámetro “path”: se pasa directamente a “idx.GetRealPath()” sin llamar a “SanitizeUserPath()”, permitiendo a un atacante escapar de la raíz de almacenamiento y establecer “parentDir” a cualquier directorio en el host. No se requiere ningún archivo ancla existente. El vector secundario es el parámetro “name”: se une con “parentDir” a través de “filepath.Join(parentDir, name)” sin eliminar componentes de directorio, permitiendo el salto de ruta relativo a cualquier “parentDir” resuelto. Cualquier usuario autenticado (independientemente del rol o los permisos) puede explotar cualquiera de los vectores para leer cualquier archivo de texto legible por el proceso del servidor, incluyendo “/etc/p4ssd”, claves SSH, credenciales de base de datos y claves de firma JWT. La versión 1.4.3-beta corrige el problema."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"gtsteffaniak","product":"filebrowser","versions":[{"version":"< 1.4.3-beta","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","baseScore":7.7,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.1,"impactScore":4.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-20T14:51:53.928655Z","id":"CVE-2026-54910","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-22"},{"lang":"en","value":"CWE-23"}]}],"references":[{"url":"https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a","source":"security-advisories@github.com"},{"url":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w","source":"security-advisories@github.com"},{"url":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}