# CVE-2026-116682: FileBrowser symlink escape vulnerability in file read operations

Source: https://junglewise.ai/threats/cve-2026-116682-filebrowser-quantum-is-a-free-self-hosted-web-based-file-manager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-116682 · Severity: high · CVSS 8.6 · Published 2026-10-27

FileBrowser is a self-hosted web-based file manager that allows users to browse and download files. A vulnerability in symlink handling allows authenticated users and public-share holders to read files outside their authorized scope by following symbolic links to out-of-bounds targets. This could expose sensitive server files to unauthorized access.

Technologies: [github.com/gtsteffaniak/filebrowser/backend (Go)](https://junglewise.ai/threats/technologies/github-com-gtsteffaniak-filebrowser-backend). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Gtsteffaniak](https://junglewise.ai/threats/vendors/gtsteffaniak).

## Quick answers

**Is CVE-2026-116682 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116682 being exploited in the wild.

**How severe is CVE-2026-116682?** High severity, with a CVSS score of 8.6, published 27 October 2026.

**Which products and versions are affected?** github.com/gtsteffaniak/filebrowser/backend (Go) < 0.0.0-20260814233832-4126edeb07a0, SEMVER:introduced=0,fixed=0.0.0-20260814233832-4126edeb07a0; Gtsteffaniak FileBrowser before 1.5.2-stable and before 2.0.1-beta.

**Is there a fix for CVE-2026-116682?** Yes. github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260814233832-4126edeb07a0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116682 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-116682?** Check whether you run github.com/gtsteffaniak/filebrowser/backend (Go) or Gtsteffaniak FileBrowser at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260814233832-4126edeb07a0 or later

  ```sh
  go get github.com/gtsteffaniak/filebrowser/backend@v0.0.0-20260814233832-4126edeb07a0
  ```


## Technical details

The vulnerability exists in backend/pkg/indexing/indexingFiles.go where GetRealPath resolves symbolic links without validating that the resolved target remains within the source root and user's authorized scope. Multiple read flows (download, preview, media, OnlyOffice, public-share) that enable FollowSymlinks are affected. An authenticated user with download access or a public-share holder can exploit reachable in-scope symlinks to access out-of-scope files.

## Affected products

- gtsteffaniak FileBrowser before 1.5.2-stable and before 2.0.1-beta

## Identifiers

- CVE-2026-116682
- GHSA-mgqf-5mf5-prfj
- GO-2026-6870

## Timeline

- 2026-10-27: disclosed

## References

- [https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67](https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67)
- [https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38](https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38)

## Related threats

- [gtsteffaniak FileBrowser Quantum path traversal in subtitlesHandler](https://junglewise.ai/threats/cve-2026-54910-gtsteffaniak-filebrowser-quantum-path-traversal-in)
- [gtsteffaniak FileBrowser Quantum username enumeration via timing side-channel](https://junglewise.ai/threats/cve-2026-54685-gtsteffaniak-filebrowser-quantum-username-enumeration-via-timing)
- [FileBrowser Quantum information disclosure to unauthenticated users](https://junglewise.ai/threats/cve-2026-46410-filebrowser-quantum-information-disclosure-to-unauthenticated)
- [gtsteffaniak FileBrowser Quantum path traversal in public share handler](https://junglewise.ai/threats/cve-2026-48777-gtsteffaniak-filebrowser-quantum-path-traversal-in-public-share)
- [FileBrowser Quantum: Password-Protected Share Bypass via /public/api/share/info](https://junglewise.ai/threats/cve-2026-30933-filebrowser-quantum-password-protected-share-bypass-via-public)