CVE-2026-54910: FileBrowser Quantum Path Traversal Flaw

CVE-2026-54910 Overview

CVE-2026-54910 is a path traversal vulnerability [CWE-22] in FileBrowser Quantum, a self-hosted, web-based file manager. The flaw resides in the subtitlesHandler endpoint (GET /api/media/subtitles), which accepts two user-controlled query parameters, path and name, and uses them in filesystem operations without sanitization. Any authenticated user, regardless of role, can escape the storage root and read arbitrary text files readable by the server process. Sensitive targets include /etc/passwd, SSH private keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the vulnerability.

Critical Impact
Authenticated attackers can read arbitrary server-side files, including credentials and cryptographic keys, leading to full system compromise.

Affected Products

FileBrowser Quantum prior to 1.4.3-beta
subtitlesHandler endpoint (GET /api/media/subtitles)
Deployments exposing the FileBrowser Quantum API to authenticated users

Discovery Timeline

2026-07-20 - CVE-2026-54910 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-54910

Vulnerability Analysis

The subtitlesHandler endpoint exposes two independent path traversal vectors through query parameter handling. Both parameters flow into filesystem operations without validation. An authenticated user with any role can trigger file reads outside the intended storage root.

The primary vector is the path parameter. It is passed directly to idx.GetRealPath() without a preceding call to SanitizeUserPath(). This allows an attacker to set parentDir to any directory on the host filesystem, and no anchor file needs to pre-exist inside the traversed directory.

The secondary vector is the name parameter. It is combined with parentDir via filepath.Join(parentDir, name) without stripping directory components such as ../. This allows traversal relative to any parentDir previously resolved. Chaining both parameters gives an attacker full control over the resolved absolute path.

Root Cause

The root cause is missing input sanitization on user-controlled path segments. SanitizeUserPath() is bypassed for the path parameter, and filepath.Join does not reject relative traversal sequences supplied through the name parameter. The endpoint also fails to enforce role- or permission-based restrictions on subtitle retrieval.

Attack Vector

Exploitation requires only valid authentication and network access to the FileBrowser Quantum API. An attacker issues a GET request to /api/media/subtitles with a crafted path value pointing outside the storage root and a name value containing traversal sequences. The server returns the contents of the targeted file if the server process has read permissions. See the GitHub Security Advisory GHSA-vvp7-h4fj-m28w for the full technical write-up.

Detection Methods for CVE-2026-54910

Indicators of Compromise

Requests to /api/media/subtitles containing ../ sequences in the path or name query parameters.
Access log entries where the resolved subtitle path points outside configured storage roots such as /etc/, /root/, or /home/*/.ssh/.
Unexpected reads of sensitive files (/etc/passwd, id_rsa, .env, JWT signing key files) attributed to the FileBrowser Quantum process.
Authenticated sessions from low-privilege accounts issuing repeated subtitle requests with varying path values.

Detection Strategies

Inspect HTTP access logs for GET /api/media/subtitles requests and decode query parameters to flag traversal patterns.
Deploy web application firewall rules that reject ../, URL-encoded %2e%2e%2f, and absolute paths in the path and name parameters.
Correlate subtitle endpoint activity with the authenticated user role to identify low-privilege accounts probing sensitive paths.

Monitoring Recommendations

Alert on file access by the FileBrowser Quantum process to paths outside its configured storage roots.
Monitor for anomalous read patterns on credential files, SSH keys, and application secrets on hosts running FileBrowser Quantum.
Track authentication events followed by rapid enumeration of the /api/media/subtitles endpoint.

How to Mitigate CVE-2026-54910

Immediate Actions Required

Upgrade FileBrowser Quantum to version 1.4.3-beta or later, which fixes both traversal vectors.
Rotate any credentials, SSH keys, database passwords, and JWT signing keys that were readable by the FileBrowser Quantum process.
Audit authentication logs and access logs for prior exploitation of /api/media/subtitles.
Restrict network exposure of the FileBrowser Quantum API to trusted networks until patched.

Patch Information

The fix is delivered in FileBrowser Quantum 1.4.3-beta. The patch is available in the upstream commit f3f4bbe and documented in the GitHub Security Advisory GHSA-vvp7-h4fj-m28w. The patch applies SanitizeUserPath() to the path parameter and strips directory components from name before joining.

Workarounds

Block or filter requests to /api/media/subtitles at a reverse proxy or WAF until the patch is applied.
Run the FileBrowser Quantum process under a dedicated low-privilege user with read access restricted to its storage root using filesystem ACLs or a chroot/container mount.
Disable or restrict authenticated account creation to trusted operators only while the vulnerability remains unpatched.

bash

# Example NGINX rule to block traversal attempts against the subtitles endpoint
location /api/media/subtitles {
    if ($args ~* "(\.\./|%2e%2e%2f|%2e%2e/)") {
        return 403;
    }
    proxy_pass http://filebrowser_backend;
}