FileBrowser Quantum (< 1.5.2-Stable, < 2.0.1-Beta) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/filebrowser-quantum--1.5.2-stable--2.0.1-beta/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 27 Oct 2026 20:04:34 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFileBrowser Quantum: Arbitrary file read via symbolic link traversal (CVE-2026-116682)https://feed.craftedsignal.io/briefs/2026-10-filebrowser-quantum-path-traversal/Tue, 27 Oct 2026 20:04:34 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-filebrowser-quantum-path-traversal/FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta contain a path-traversal vulnerability that allows authenticated or unauthorized users to read arbitrary server files by exploiting improperly validated symbolic links.FileBrowser Quantum versions prior to 1.5.2-stable and 2.0.1-beta are vulnerable to an arbitrary file read flaw (CVE-2026-116682) located in the backend file indexing logic. The application fails to validate symbolic links during resolution, allowing the service to traverse outside of the authorized root directory. This vulnerability affects multiple file access flows, including file downloads, previews, media rendering, OnlyOffice integration, and public shares. An attacker can access sensitive system files by placing a symlink within an accessible directory that points to an out-of-scope target on the host filesystem.

Impact

Successful exploitation allows authenticated users, or unauthenticated users via public share links, to read arbitrary files from the underlying server filesystem. This can lead to the exposure of configuration files, credentials, or other sensitive system data.

Recommendation

  • Upgrade FileBrowser Quantum to version 1.5.2-stable, 2.0.1-beta, or later immediately to apply the patch for CVE-2026-116682.
  • Audit existing shared directories for the presence of symbolic links that may point to sensitive host filesystem locations (e.g., /etc/shadow, configuration files).
  • Review access logs for web requests to the file manager that include unexpected traversal patterns or attempt to resolve symlink structures.
]]>highadvisoryfile-readpath-traversalwebservercve-2026-116682