Executive brief
FileBrowser Quantum is a web-based file management tool. A vulnerability in the public sharing feature allows anyone with a 'modify' link to move, rename, or copy files they shouldn't have access to. This could allow an attacker to steal sensitive documents or overwrite critical system files by escaping the folder they were originally given access to.
Technical details
A path traversal vulnerability exists in the `publicPatchHandler` within `backend/http/public.go`. The application joins user-provided `fromPath` and `toPath` fields with the base share path using `filepath.Join` before performing validation. Because `filepath.Join` resolves '..' segments, the subsequent call to `SanitizeUserPath` fails to detect the traversal. An unauthenticated attacker with a public share link where `AllowModify=true` can move, copy, or rename arbitrary files within the share owner's source root. This can be used to exfiltrate files by moving them into the shared directory or to compromise integrity by overwriting files. The issue was addressed by reordering operations to sanitize paths before joining them.
Affected products
- gtsteffaniak FileBrowser Quantum (gtsteffaniak/filebrowser) < 0.0.0-20260518193514-28e9b81e438e
Timeline
- 2026-05-07: other: Vulnerability verified on commit 869b640
- 2026-05-16: advisory: GitHub Advisory published
- 2026-05-18: patched: Fixed in version 0.0.0-20260518193514-28e9b81e438e