CVE-2026-116682
CVE-2026-116682 · FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
CVSS 8.6 · Alta · EPSS 0,5%
- Publicación
- Actualización
Productos y versiones afectados
filebrowser
- Versiones
- < 1.5.2-stable: Afectada
- >= 2.0.0-beta, < 2.0.1-beta: Afectada
Sin corrección publicada
Fuentes originales
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-mgqf-5mf5-prfj
- https://github.com/gtsteffaniak/filebrowser/pull/2795
- https://github.com/gtsteffaniak/filebrowser/pull/2800
- https://github.com/gtsteffaniak/filebrowser/commit/3c8c02414eefd3351ffe437fa39ff6eb150ffa67
- https://github.com/gtsteffaniak/filebrowser/commit/4126edeb07a015c3809a89249b283e07a4e50c38
- https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.5.2-stable
- https://github.com/gtsteffaniak/filebrowser/releases/tag/v2.0.1-beta
- https://nvd.nist.gov/vuln/detail/CVE-2026-116682