PT-2026-61605 · Unknown · Filebrowser Quantum

CVE-2026-54910 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum versions prior to 1.4.3-beta

Description The subtitlesHandler endpoint (GET /api/media/subtitles) contains path traversal flaws due to insufficient sanitization of the path and name query parameters. The path parameter is passed to idx.GetRealPath() without using SanitizeUserPath(), enabling an attacker to escape the storage root. Additionally, the name parameter is joined with the parent directory without removing directory components, allowing further traversal. Any authenticated user can exploit these vectors to read sensitive text files accessible by the server process, such as SSH keys, database credentials, JWT signing keys, and /etc/passwd.

Recommendations Update to version 1.4.3-beta. As a temporary workaround, restrict access to the GET /api/media/subtitles endpoint.

Exploit

Fix

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2026-54910

GHSA-VVP7-H4FJ-M28W

Affected Products

Filebrowser Quantum

References · 5

• 🔥 https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54910.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-54910 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54910 · Security Note
• https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a · Note