{"id":"EUVD-2026-111279","enisaUuid":"0de1c0ad-a9c2-3d9d-a10c-4cffe68df1a0","description":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user\u0027s authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.","datePublished":"Oct 27, 2026, 5:48:04 PM","dateUpdated":"Oct 27, 2026, 5:48:04 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj\nhttps://github.com/gtsteffaniak/filebrowser/pull/2795\nhttps://github.com/gtsteffaniak/filebrowser/pull/2800\nhttps://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67\nhttps://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38\nhttps://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable\nhttps://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta\n","aliases":"CVE-2026-116682\nGHSA-mgqf-5mf5-prfj\n","assigner":"GitHub_M","epss":0.0,"enisaIdProduct":[{"id":"2cddb448-8b45-39a0-900c-532a4667924b","product":{"name":"filebrowser","vendor":{"name":"gtsteffaniak"}},"product_version":"2.0.0-beta, \u003c 2.0.1-beta"},{"id":"2ec41dba-9c57-347a-ad32-3a257c97ec43","product":{"name":"filebrowser","vendor":{"name":"gtsteffaniak"}},"product_version":"\u003c 1.5.2-stable"}],"enisaIdVendor":[{"id":"73aed9bd-4c9c-3bc3-a558-3b881d2dc245","vendor":{"name":"gtsteffaniak"}}],"enisaIdVulnerability":[{"id":"0eff5a85-cc37-397f-ba06-47f73534d91d","vulnerability":{"id":"CVE-2026-116682","description":"FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user\u0027s authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.","datePublished":"Oct 27, 2026, 5:48:04 PM","dateUpdated":"Oct 27, 2026, 5:48:04 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","references":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj\nhttps://github.com/gtsteffaniak/filebrowser/pull/2795\nhttps://github.com/gtsteffaniak/filebrowser/pull/2800\nhttps://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67\nhttps://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38\nhttps://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable\nhttps://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta\n","enisa_id":"EUVD-2026-111279\n","assigner":"GitHub_M","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:00:18 AM","vulnerabilityProduct":[{"id":"77c0241d-a989-329e-9785-cc3541e19838","product":{"name":"filebrowser","vendor":{"name":"gtsteffaniak"}},"product_version":"2.0.0-beta, \u003c 2.0.1-beta"},{"id":"8ec8823d-b007-3ade-a53b-b9e93636dc66","product":{"name":"filebrowser","vendor":{"name":"gtsteffaniak"}},"product_version":"\u003c 1.5.2-stable"}],"vulnerabilityVendor":[{"id":"0c811168-6df5-39f8-87f6-96e9d6e10d1f","vendor":{"name":"gtsteffaniak"}}]}},{"id":"f6b5a46e-e658-3dc4-8f01-0b3e2ac38577","vulnerability":{"id":"GHSA-mgqf-5mf5-prfj","description":"FileBrowser: Symlink following escapes user scope allowing arbitrary file read outside the served directory","datePublished":"Oct 27, 2026, 9:04:40 PM","dateUpdated":"Oct 27, 2026, 9:04:41 PM","baseScore":0.0,"references":"https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-116682\nhttps://github.com/gtsteffaniak/filebrowser/pull/2795\nhttps://github.com/gtsteffaniak/filebrowser/pull/2800\nhttps://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67\nhttps://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38\nhttps://github.com/gtsteffaniak/filebrowser\nhttps://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable\nhttps://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta\n","enisa_id":"EUVD-2026-111279\n","aliases":"CVE-2026-116682\nGHSA-mgqf-5mf5-prfj\n","epss":0.0,"dataProcessed":"Oct 28, 2026, 2:02:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}