{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/tags/cve-2026-54910/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-54910"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["filebrowser/backend"],"_cs_severities":["high"],"_cs_tags":["path-traversal","cve-2026-54910","filebrowser"],"_cs_type":"advisory","_cs_vendors":["FileBrowser"],"content_html":"\u003cp\u003eFileBrowser is vulnerable to a path traversal issue in the \u003ccode\u003esubtitlesHandler\u003c/code\u003e endpoint (GET /api/media/subtitles) due to improper input sanitization of the \u003ccode\u003epath\u003c/code\u003e and \u003ccode\u003ename\u003c/code\u003e query parameters. This vulnerability, identified as CVE-2026-54910, affects the \u003ccode\u003efilebrowser\u003c/code\u003e backend versions prior to \u003ccode\u003e0.0.0-20260608182036-f3f4bbe80cb5\u003c/code\u003e. The flaw allows any authenticated user, regardless of their assigned permissions, to bypass storage scope restrictions and read arbitrary text files on the host filesystem that the application process has access to.\u003c/p\u003e\n\u003cp\u003eThe vulnerability manifests through two distinct vectors. First, the \u003ccode\u003epath\u003c/code\u003e parameter is passed directly to filesystem operations without calling \u003ccode\u003eSanitizeUserPath()\u003c/code\u003e, enabling full directory traversal. Second, the \u003ccode\u003ename\u003c/code\u003e parameter is concatenated via \u003ccode\u003efilepath.Join\u003c/code\u003e without stripping directory components, also allowing traversal if a valid anchor file is present. An attacker can use these vectors to exfiltrate sensitive files such as \u003ccode\u003e/etc/passwd\u003c/code\u003e, SSH private keys, database credentials, and application JWT signing keys. The only functional constraint is that the target file must be valid UTF-8 and under 50MB in size.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the FileBrowser instance using valid user credentials.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious HTTP GET request to the \u003ccode\u003e/api/media/subtitles\u003c/code\u003e endpoint.\u003c/li\u003e\n\u003cli\u003eAttacker injects path traversal sequences (e.g., \u003ccode\u003e../../etc/passwd\u003c/code\u003e) into the \u003ccode\u003epath\u003c/code\u003e query parameter.\u003c/li\u003e\n\u003cli\u003eThe application logic executes \u003ccode\u003eidx.GetRealPath()\u003c/code\u003e using the unsanitized \u003ccode\u003epath\u003c/code\u003e input, resolving the directory outside of the intended storage scope.\u003c/li\u003e\n\u003cli\u003eThe application calls \u003ccode\u003eutils.GetSubtitleSidecarContent()\u003c/code\u003e with the traversed path.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eos.ReadFile()\u003c/code\u003e function within the utility module opens the target file on the host filesystem.\u003c/li\u003e\n\u003cli\u003eThe application returns the contents of the file in the HTTP response body to the attacker.\u003c/li\u003e\n\u003cli\u003eAttacker parses the response to exfiltrate sensitive configuration files, secrets, or system credentials.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe impact of this vulnerability is significant, as it enables arbitrary file read on the host machine. Successful exploitation grants attackers access to system-level files like \u003ccode\u003e/etc/passwd\u003c/code\u003e and application-level secrets such as JWT signing keys, which facilitate administrative token forgery and full system compromise. The attack requires only basic authentication, making it accessible to any compromised low-privileged user account within the environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized, concrete actions for detection engineering teams:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious HTTP requests targeting the subtitle endpoint with traversal sequences.\u003c/li\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003efilebrowser\u003c/code\u003e backend to the latest version, as specified in the vendor advisory for CVE-2026-54910.\u003c/li\u003e\n\u003cli\u003eImplement strict ingress filtering at the Web Application Firewall (WAF) layer to block any HTTP requests containing directory traversal sequences (e.g., \u003ccode\u003e../\u003c/code\u003e, \u003ccode\u003e..%2f\u003c/code\u003e) directed at the \u003ccode\u003e/api/media/subtitles\u003c/code\u003e path.\u003c/li\u003e\n\u003cli\u003eAudit logs for the \u003ccode\u003e/api/media/subtitles\u003c/code\u003e endpoint to identify successful requests from non-administrative users that result in unusual file content retrieval patterns.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-01T01:47:40Z","date_published":"2026-08-01T01:47:40Z","id":"https://feed.craftedsignal.io/briefs/2026-08-filebrowser-traversal/","summary":"An unauthenticated-accessible path traversal vulnerability in FileBrowser's subtitle handler allows authenticated users to read arbitrary files from the host filesystem, leading to potential credential theft and privilege escalation.","title":"Path Traversal in FileBrowser Subtitle Handler","url":"https://feed.craftedsignal.io/briefs/2026-08-filebrowser-traversal/"}],"language":"en","title":"CraftedSignal Threat Feed - Cve-2026-54910","version":"https://jsonfeed.org/version/1.1"}