FileBrowser Quantum: Arbitrary file read via symbolic link traversal (CVE-2026-116682)

FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta are vulnerable to an arbitrary file read flaw (CVE-2026-116682) located in the backend file indexing logic. The application fails to validate symbolic links during resolution, allowing the service to traverse outside of the authorized root directory. This vulnerability affects multiple file access flows, including file downloads, previews, media rendering, OnlyOffice integration, and public shares. An attacker can access sensitive system files by placing a symlink within an accessible directory that points to an out-of-scope target on the host filesystem.

Impact

Successful exploitation allows authenticated users, or unauthenticated users via public share links, to read arbitrary files from the underlying server filesystem. This can lead to the exposure of configuration files, credentials, or other sensitive system data.

Recommendation

• Upgrade FileBrowser Quantum to version 1.5.2-stable, 2.0.1-beta, or later immediately to apply the patch for CVE-2026-116682.
• Audit existing shared directories for the presence of symbolic links that may point to sensitive host filesystem locations (e.g., /etc/shadow, configuration files).
• Review access logs for web requests to the file manager that include unexpected traversal patterns or attempt to resolve symlink structures.