File Read Handling Vulnerability in FileBrowser Quantum by GT Steffaniak
CVE-2026-116682
8.6HIGH
What is CVE-2026-116682?
The vulnerability in FileBrowser Quantum allows authenticated users with download access to read files outside their authorized scope due to improper handling of symbolic links. This issue arises because the system resolves symlinks without verifying the target's compliance with the source root. As a result, both authenticated users and those with public share links can potentially access sensitive files that should remain restricted. The vulnerability has been addressed in versions 1.5.2-stable and 2.0.1-beta. Users are advised to upgrade promptly to safeguard their data.
Affected Version(s)
filebrowser < 1.5.2-stable < 1.5.2-stable
filebrowser >= 2.0.0-beta, < 2.0.1-beta < 2.0.0-beta, 2.0.1-beta