Live › vulnerability › CVE-2026-116682
Go to dashboardFileBrowser Quantum follows symbolic links during file reads without checking that the target stays inside the shared root and the user's allowed scope. An authenticated user with download access, or anyone holding a public share link to a directory containing such a symlink, can read server files outside that scope.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 18:32 UTC. All times on this page are UTC.
Deployments that run FileBrowser Quantum below the fixed versions with symlink following turned on, since that is what lets a link escape the allowed root. Instances that serve only directories without symlinks, or that keep symlink following disabled, are less exposed. Operators who run only the patched releases can skip it.
No product ranges from the sources yet.
filebrowser --version or the admin UI; versions below 1.5.2-stable or 2.0.1-beta are exposed.FollowSymlinks enabled in the configuration and for symlinks inside served directories, for example find /srv/files -type l.1.5.2-stable or 2.0.1-beta.FollowSymlinks or remove symlinks that point outside the served root.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
This page as .md · .json · in your agent: get_signal("CVE-2026-116682")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.