FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.5.2-stable, 2.0.1-beta, 0.0.0-20260814233832-4126edeb07a0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
FileBrowser Quantum, a self-hosted web-based file manager, is affected when symbolic link following is enabled for download, preview, media, OnlyOffice, or public-share file access. A logged-in user with download rights, or anyone holding a public share link, could use a symlink inside an allowed folder to read server files outside their permitted directory.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- gtsteffaniak filebrowser
fixed in 1.5.2-stable; From 2.0.0-beta · fixed in 2.0.1-beta
- github.com/gtsteffaniak/filebrowser/backendGo
fixed in 0.0.0-20260814233832-4126edeb07a0