{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afilebrowser_quantumfilebrowser_quantum/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:filebrowser_quantum:filebrowser_quantum:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.6,"id":"CVE-2026-116682"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FileBrowser Quantum (\u003c 1.5.2-stable, \u003c 2.0.1-beta)"],"_cs_severities":["high"],"_cs_tags":["file-read","path-traversal","webserver","cve-2026-116682"],"_cs_type":"advisory","_cs_vendors":["FileBrowser Quantum"],"content_html":"\u003cp\u003eFileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta are vulnerable to an arbitrary file read flaw (CVE-2026-116682) located in the backend file indexing logic. The application fails to validate symbolic links during resolution, allowing the service to traverse outside of the authorized root directory. This vulnerability affects multiple file access flows, including file downloads, previews, media rendering, OnlyOffice integration, and public shares. An attacker can access sensitive system files by placing a symlink within an accessible directory that points to an out-of-scope target on the host filesystem.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users, or unauthenticated users via public share links, to read arbitrary files from the underlying server filesystem. This can lead to the exposure of configuration files, credentials, or other sensitive system data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade FileBrowser Quantum to version 1.5.2-stable, 2.0.1-beta, or later immediately to apply the patch for CVE-2026-116682.\u003c/li\u003e\n\u003cli\u003eAudit existing shared directories for the presence of symbolic links that may point to sensitive host filesystem locations (e.g., /etc/shadow, configuration files).\u003c/li\u003e\n\u003cli\u003eReview access logs for web requests to the file manager that include unexpected traversal patterns or attempt to resolve symlink structures.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T20:04:34Z","date_published":"2026-10-27T20:04:34Z","id":"https://feed.craftedsignal.io/briefs/2026-10-filebrowser-quantum-path-traversal/","summary":"FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta contain a path-traversal vulnerability that allows authenticated or unauthorized users to read arbitrary server files by exploiting improperly validated symbolic links.","title":"FileBrowser Quantum: Arbitrary file read via symbolic link traversal (CVE-2026-116682)","url":"https://feed.craftedsignal.io/briefs/2026-10-filebrowser-quantum-path-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:filebrowser_quantum:filebrowser_quantum:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}