IT SBIT Services
Schneeberger
DEEN
CVE tracker

FileBrowser Quantum: Symlink following escapes user scope allowing file read

CVE-2026-116682High 8.6

← All vulnerabilities

Summary

FileBrowser Quantum, a self-hosted web file manager, resolves symbolic links on read paths without checking that the target stays inside the source root and the user's authorized scope. An authenticated user with download access, or anyone holding a public share link that exposes such a symlink, can read server-accessible files outside their scope. The issue only applies where FollowSymlinks is enabled and the instance contains reachable symlinks; the CVSS score of 8.6 comes from the CNA record and NVD analysis was still pending at the time of writing.

Affected

  • FileBrowser Quantum before 1.5.2-stable
  • FileBrowser Quantum 2.0.0-beta (2.0.0-beta up to but not including 2.0.1-beta)

Fixed in

  • 1.5.2-stable
  • 2.0.1-beta
  • Newer stable releases (the most recent 1.5.x or 2.0.x stable release is recommended; verify the current version on the releases page)

Workaround

  • No vendor-documented interim workaround found.
  • Disable FollowSymlinks where it is not required.
  • Remove symlinks from shared trees that point outside the root, and do not bind-mount host directories containing symlinks.
  • Disable public shares until patched.

Exploitation

  • Unknown whether exploitation occurs in the wild; no evidence found.
  • The vendor advisory reports a confirmed reproduction in a lab on version 1.3.3-stable; public PoC status is reported inconsistently across sources.
  • Not listed in CISA KEV at the time of writing.
  • EPSS: 0.54 % (45th percentile).

Our recommendation

  • Inventory all FileBrowser instances, including any original FileBrowser installations, and record their versions.
  • Upgrade Quantum instances to the latest 1.5.x or 2.0.x stable release and confirm the fix in the release notes.
  • Until patched, disable public shares, check FollowSymlinks settings and search shared trees for symlinks pointing outside the root.
  • Review access logs for public share requests and unusual downloads.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:00.

Original description (NVD)

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.

NVD references (7)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed