CVE-2026-46410: FileBrowser Quantum Info Disclosure Flaw

CVE-2026-46410 Overview

CVE-2026-46410 is an information disclosure vulnerability in FileBrowser Quantum, a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak sensitive information, including source and path data. The vulnerability is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Remote attackers can exploit the flaw over the network without authentication or user interaction. The maintainers released patched builds in versions 1.3.2-stable and 1.4.1-beta. No workarounds exist for affected deployments.

Critical Impact
Unauthenticated remote attackers can obtain sensitive filesystem metadata, including source and path information, from vulnerable FileBrowser Quantum instances.

Affected Products

FileBrowser Quantum versions prior to 1.3.2-stable
FileBrowser Quantum beta versions prior to 1.4.1-beta
Self-hosted deployments exposing the web-based file manager interface

Discovery Timeline

2026-07-20 - CVE-2026-46410 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-46410

Vulnerability Analysis

FileBrowser Quantum exposes sensitive information through insufficient access controls in its user settings handling logic. The flaw allows unauthenticated anonymous users to access data that should be restricted to authorized accounts. According to the vendor advisory, the leaked information includes source and path metadata, which can aid attackers in reconnaissance and further exploitation of the hosting environment.

The vulnerability is classified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. The Exploit Prediction Scoring System (EPSS) rates this issue at 0.263%.

Root Cause

The root cause lies in the user settings assignment logic within backend/common/settings/settings.go. Anonymous user sessions received permission and account attributes from the default user configuration without an early exit check. The patch introduces an explicit guard that returns before assigning permissions when the requesting username is anonymous, preventing leakage of source, path, and permission metadata.

Attack Vector

Exploitation requires only network access to the FileBrowser Quantum web interface. No authentication or user interaction is needed. An attacker sends requests as the anonymous user context and retrieves configuration and path information that should be restricted. Refer to the GitHub Security Advisory GHSA-3jmg-p96m-m328 for advisory details.

 // FileLoading settings
 u.FileLoading = d.FileLoading

+ if u.Username == "anonymous" {
+     return
+ }
+
 // Permissions
 u.Permissions.Api = d.Account.Permissions.Api
 u.Permissions.Admin = d.Account.Permissions.Admin

Source: GitHub Commit 1802e128 — the patch adds an early return for anonymous users, preventing further permission and configuration assignments that leaked sensitive data.

Detection Methods for CVE-2026-46410

Indicators of Compromise

Unauthenticated HTTP requests to FileBrowser Quantum API endpoints returning permission or path metadata
Access log entries showing repeated anonymous session queries against user or settings endpoints
Outbound reconnaissance traffic following exposure of internal directory paths

Detection Strategies

Inventory all self-hosted FileBrowser Quantum instances and confirm running versions against 1.3.2-stable or 1.4.1-beta
Review web application logs for anonymous requests that receive non-empty user settings or path data in responses
Correlate access to FileBrowser endpoints with subsequent scanning or lateral movement attempts against exposed paths

Monitoring Recommendations

Alert on HTTP responses from FileBrowser Quantum containing permission attributes when the session is unauthenticated
Monitor for spikes in anonymous session activity against file manager endpoints
Track version banners and build strings exposed by FileBrowser Quantum deployments to identify unpatched hosts

How to Mitigate CVE-2026-46410

Immediate Actions Required

Upgrade FileBrowser Quantum to version 1.3.2-stable or 1.4.1-beta without delay
Restrict network exposure of FileBrowser Quantum instances to trusted networks or place them behind an authenticating reverse proxy
Audit logs for prior anonymous access and rotate any credentials or paths that may have been disclosed

Patch Information

The maintainers fixed the issue in FileBrowser Quantum 1.3.2-stable and 1.4.1-beta. The patch is available in GitHub Commit 1802e128 and documented in GHSA-3jmg-p96m-m328. Upgrading is the only supported remediation.

Workarounds

No workarounds are available per the vendor advisory
Operators unable to patch immediately should remove public network exposure and require authentication at an upstream proxy

bash

# Verify installed FileBrowser Quantum version and upgrade
filebrowser version
# Pull the patched release
docker pull gtstef/filebrowser:1.3.2-stable
docker stop filebrowser && docker rm filebrowser
docker run -d --name filebrowser gtstef/filebrowser:1.3.2-stable