CVE-2026-116682: FileBrowser Quantum: Symlink following escapes user scope allowing arbitrary file read outside the served directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remains inside the source root and the user's authorized scope. Download, preview, media, OnlyOffice, and public-share read flows that enable FollowSymlinks can therefore serve an out-of-scope target through a reachable in-scope symlink. An authenticated user with download access can read server-accessible files outside the assigned scope, and a holder of a public share link can do the same without an account when the shared directory exposes such a symlink. This issue is fixed in 1.5.2-stable and 2.0.1-beta.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FileBrowser Quantumto a version that resolves this vulnerability.Fixed in 1.5.2-stable - Upgrade
Upgrade
FileBrowser Quantumto a version that resolves this vulnerability.Fixed in 2.0.1-beta
Event History
Frequently Asked Questions
Which deployments are exposed to unauthenticated access?
A deployment is exposed without an account when it has a public share link for a directory containing a reachable symbolic link to a target outside the shared directory or authorized scope, and the relevant read flow follows symlinks.
What access does an authenticated attacker need?
An authenticated attacker needs download access and a reachable in-scope symbolic link whose target is outside their assigned scope. The affected read paths include download, preview, media, and OnlyOffice flows when FollowSymlinks is enabled.
Are all FileBrowser Quantum versions affected?
The issue affects versions prior to 1.5.2-stable and 2.0.1-beta. It is fixed in 1.5.2-stable and 2.0.1-beta.
What can be done if upgrading is not immediately possible?
Disable or avoid read flows that enable FollowSymlinks, and remove or restrict access to symbolic links that resolve outside the served directory or users' authorized scopes. Review public shares especially, because a share-link holder may exploit an exposed symlink without authentication.
How can administrators identify potentially affected content?
Inspect served and shared directories for symbolic links, then determine whether their resolved targets fall outside the source root or the intended authorized scope. Prioritize links reachable through downloads, previews, media, OnlyOffice, or public-share read paths where FollowSymlinks is enabled.