CVE-2026-48777: gtsteffaniak FileBrowser Quantum path traversal in public share handler

CVE-2026-48777 · Severity: medium · CVSS 4 · Published 2026-06-16

FileBrowser Quantum is a self-hosted web-based file manager. A security flaw in the public sharing feature allows anyone with a "modify" enabled share link to bypass directory restrictions. An attacker can use this to move, rename, or copy files they shouldn't have access to, potentially leading to the theft of sensitive data or the modification of critical system files within the owner's storage.

Technologies: github.com/gtsteffaniak/filebrowser/backend (Go), Gtsteffaniak FileBrowser Quantum. Vendors: Go, Gtsteffaniak.

Quick answers

Is CVE-2026-48777 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48777 being exploited in the wild.
How severe is CVE-2026-48777?
Medium severity, with a CVSS score of 4, published 16 June 2026.
Which products and versions are affected?
github.com/gtsteffaniak/filebrowser/backend (Go) SEMVER:introduced=0,fixed=0.0.0-20260518193514-28e9b81e438e; Gtsteffaniak FileBrowser Quantum < 1.3.3-stable, < 1.4.2-beta.
Is there a fix for CVE-2026-48777?
Yes. github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260518193514-28e9b81e438e or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48777 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-48777?
Check whether you run github.com/gtsteffaniak/filebrowser/backend (Go) or Gtsteffaniak FileBrowser Quantum at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/gtsteffaniak/filebrowser/backend (Go): upgrade to 0.0.0-20260518193514-28e9b81e438e or later
    go get github.com/gtsteffaniak/filebrowser/backend@v0.0.0-20260518193514-28e9b81e438e

Technical details

A path traversal vulnerability exists in the `publicPatchHandler` within `backend/http/public.go`. The application uses `filepath.Join` (via `JoinPathAsUnix`) on user-provided `fromPath` and `toPath` fields before passing them to the `SanitizeUserPath` function. Because `filepath.Join` collapses '..' segments, the downstream sanitizer fails to detect the traversal, allowing the path to escape the intended share root. An unauthenticated attacker with a public share link where `AllowModify=true` can move, copy, or rename arbitrary files within the share owner's source root. This can be used to move sensitive files into the shared folder for download or overwrite existing files. The issue is fixed in versions 1.3.3-stable and 1.4.2-beta.

Affected products

  • gtsteffaniak FileBrowser Quantum < 1.3.3-stable, < 1.4.2-beta

Identifiers

  • CVE-2026-48777
  • GHSA-qqqm-5547-774x
  • GO-2026-5591

Timeline

  • 2026-05-16: advisory: GitHub Security Advisory published
  • 2026-05-18: patched: Version 1.3.3-stable released
  • 2026-05-22: patched: Version 1.4.2-beta released
  • 2026-06-16: disclosed: CVE-2026-48777 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.