CVE-2026-116682

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum versions prior to 1.5.2-stable FileBrowser Quantum versions prior to 2.0.1-beta

Description File read handling fails to verify if the target of a resolved symbolic link remains within the source root and the user's authorized scope. This occurs because the GetRealPath function resolves symbolic links using filepath.EvalSymlinks but does not perform a containment check on the resulting path. Consequently, an authenticated user with download access or an unauthenticated user with a public share link can access server-accessible files outside their assigned scope, such as /etc/passwd, SSH keys, or container secrets, provided a reachable symbolic link exists. This issue affects several read flows, including download, preview, media, OnlyOffice, and public-share endpoints.

Recommendations For versions prior to 1.5.2-stable, update to version 1.5.2-stable. For versions prior to 2.0.1-beta, update to version 2.0.1-beta. As a temporary mitigation, restrict the creation or presence of symbolic links within served directories, especially in bind-mounted environments.