FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673 Exploit, Vendor Advisory
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 9.1 · gtsteffaniakNVD modified 2026-10-25 23:10
Affected (CPE criteria) 2
cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:-:*:*:*:*:*:*cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:beta:*:*:*:*:*:*
References 2
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673 Exploit, Vendor Advisory
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673 Exploit, Vendor Advisory