high · 7.7CVE-2026-54910Jul 31, 2026

CVE-2026-54910: FileBrowser Quantum Path Traversal in Subtitle Handler

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any logged-in user of FileBrowser Quantum can read arbitrary files from the server's filesystem, including /etc/passwd and SSH keys, by passing directory-traversal sequences to the subtitle API…

Packagegithub.com/gtsteffaniak/filebrowser/backend
Ecosystemgo
Affected< 0.0.0-20260608182036-f3f4bbe80cb5
Fixed in0.0.0-20260608182036-f3f4bbe80cb5
CVE-2026-54910: FileBrowser Quantum Path Traversal in Subtitle Handler

The problem

The GET /api/media/subtitles endpoint accepts two user-controlled query parameters, path and name, and passes them into filesystem operations without sanitization.

Every other handler in the codebase calls SanitizeUserPath() before resolving a path. This handler skips it entirely, so path=../../etc/passwd resolves parentDir to /etc with no existing file required. The name parameter is then joined directly via filepath.Join(parentDir, name), giving a second independent traversal vector.

The endpoint sits behind withUser but requires no elevated permissions, so any authenticated account can exploit it.

Proof of concept

A working proof-of-concept for CVE-2026-54910 in github.com/gtsteffaniak/filebrowser/backend, with the exact payload below.

bash
# Authenticate and capture the token
TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" \
  -H "X-Password: admin" | tr -d '"')

# Vector 1: path traversal (no anchor file needed)
curl "http://localhost:18080/api/media/subtitles?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"

# Vector 2: name traversal (requires a valid in-scope file as the path anchor)
curl "http://localhost:18081/api/media/subtitles?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"

The root cause is a missing call to SanitizeUserPath() in http/media.go. That function iterates path segments and rejects any .. component, which is exactly what all sibling handlers rely on before calling idx.GetRealPath(). Because this handler omits it, the raw path value reaches filepath.Dir(realPath) and sets parentDir to any attacker-chosen directory.

The secondary vector abuses filepath.Join(parentDir, name): Go's filepath.Join resolves .. components lexically, so supplying name=../../etc/passwd escapes whatever parentDir was. The fix applies SanitizeUserPath() to path and filepath.Base() to name, reducing the latter to a bare filename and eliminating both vectors.

CWE-22 (Path Traversal) and CWE-23 (Relative Path Traversal) both apply.

The fix

Update to FileBrowser Quantum v1.4.0-stable (or v1.4.3-beta), commit f3f4bbe80cb5. The patch adds SanitizeUserPath() on the path parameter and wraps name in filepath.Base() inside subtitlesHandler in backend/http/media.go. If immediate upgrade is not possible, block unauthenticated or low-trust access to GET /api/media/subtitles at the reverse-proxy layer as a temporary measure.

Reporter not attributed.

References: [1][2][3][4][5][6]

Related research