FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 4
- StatusPublished → DeferredNVD modified 2026-10-28 15:24
- StatusReceived → PublishedNVD modified 2026-10-27 17:48
- StatusPublished → ReceivedNVD modified 2026-10-27 18:17
- First seenCVSS 8.6 · gtsteffaniakNVD modified 2026-10-27 17:48
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 7
- https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67
- https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38
- https://github.com/gtsteffaniak/filebrowser/pull/2795
- https://github.com/gtsteffaniak/filebrowser/pull/2800
- https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable
- https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj