CVE-2026-116682: CVE-2026-116682: Arbitrary File Read via Improper Symlink Resolution in FileBrowser Quantum

#security #cve #cybersecurity

CVE-2026-116682: Arbitrary File Read via Improper Symlink Resolution in FileBrowser Quantum

Vulnerability ID: CVE-2026-116682
CVSS Score: 8.6
Published: 2026-10-27

FileBrowser Quantum prior to versions 1.5.2-stable and 2.0.1-beta contains an improper link resolution vulnerability (CWE-59) in its file indexing and retrieval subsystems. When processing file read, download, preview, media streaming, OnlyOffice integration, or public share requests, the application resolves symbolic links via Go's filepath.EvalSymlinks without verifying that the canonical target path remains within the configured source root and the user's assigned access scope. Consequently, authenticated users with read access or unauthenticated holders of public share links can read arbitrary server-accessible files outside their designated directory boundaries.

TL;DR

FileBrowser Quantum fails to validate canonical paths after resolving symbolic links during file read operations. An authenticated user or an anonymous user accessing a public share can exploit an in-scope symbolic link to read arbitrary files from the underlying server filesystem. Upgrading to version 1.5.2-stable or 2.0.1-beta resolves this vulnerability by enforcing strict path containment checks and scoped root file descriptors.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-116682 (GHSA-mgqf-5mf5-prfj)
Weakness Class: CWE-59 (Improper Link Resolution) / CWE-22 (Path Traversal)
CVSS v3.1 Score: 8.6 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)
Attack Vector: Network (HTTP/HTTPS via authenticated user or anonymous public share)
Security Impact: Arbitrary File Read outside user scope and server source root
Affected Component: backend/pkg/indexing/indexingFiles.go (GetRealPath & resolvePathContext)
Patched Versions: 1.5.2-stable and 2.0.1-beta
CISA KEV Status: Not Listed

Affected Systems

FileBrowser Quantum (gtsteffaniak/filebrowser)
FileBrowser Quantum (v1.x series): < 1.5.2-stable (Fixed in: 1.5.2-stable)
FileBrowser Quantum (v2.x beta series): >= 2.0.0-beta, < 2.0.1-beta (Fixed in: 2.0.1-beta)

Code Analysis

Commit: 4126ede

fix GHSA-mgqf-5mf5-prfj (#2795) - Enforces symlink containment within source root and user scope for v1.5 branch

Commit: 3c8c024

Beta/v2.0.1 (#2800) - Enforces symlink containment within source root and user scope for v2.0 branch

Mitigation Strategies

Upgrade FileBrowser Quantum to version 1.5.2-stable (for v1.x deployments) or 2.0.1-beta (for v2.x deployments) to enforce canonical path containment checks.
Audit backend storage directories and remove symbolic links that point outside designated user scopes or source roots.
Isolate the FileBrowser Quantum process using containerization or OS mount namespaces so that sensitive host OS files and application databases are not accessible within the same filesystem namespace.
Review and restrict public share links to ensure shared directories do not contain symbolic links.

Remediation Steps:

Identify the currently deployed version of FileBrowser Quantum across all environments.
Scan all configured source roots for existing symbolic links using find /path/to/source -type l -ls and remove any unauthorized or out-of-scope links.
Pull the patched binary or container image corresponding to v1.5.2-stable or v2.0.1-beta from the official gtsteffaniak/filebrowser repository.
Restart the FileBrowser Quantum service and verify that attempts to access out-of-scope symlinks return HTTP 403 Forbidden.

References

Read the full report for CVE-2026-116682 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community