CVE-2026-54910: CVE-2026-54910: Multiple Path Traversal Vulnerabilities in FileBrowser Quantum Subtitle Handler

#security #cve #cybersecurity

CVE-2026-54910: Multiple Path Traversal Vulnerabilities in FileBrowser Quantum Subtitle Handler

Vulnerability ID: CVE-2026-54910
CVSS Score: 7.7
Published: 2026-07-31

FileBrowser Quantum (a fork of Filebrowser) prior to version 1.4.3-beta is vulnerable to multiple directory traversal flaws in its subtitle handler endpoint (GET /api/media/subtitles). This allows authenticated users with standard access to read arbitrary text files on the host system.

TL;DR

Authenticated path traversal in FileBrowser Quantum subtitle handler allows reading arbitrary system files via unvalidated query parameters.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-22
Attack Vector: Network
CVSS Score: 7.7
EPSS Score: 0.00307
Impact: Arbitrary File Read
Exploit Status: poc
KEV Status: No

Affected Systems

FileBrowser Quantum
FileBrowser Quantum: < 1.4.3-beta (Fixed in: 1.4.3-beta)

Code Analysis

Commit: f3f4bbe

Refactor media subtitles extraction, use FileInfoFaster, validate tracks and strip traversals from sidecar path

Exploit Details

GitHub Security Advisory: Exploit methodology and context details provided in the security advisory.

Mitigation Strategies

Upgrade to v1.4.3-beta or higher
Run application as a non-privileged user
Apply strict container-level or chroot isolation

Remediation Steps:

Identify running instances of FileBrowser Quantum
Pull and deploy the patched image or binary for version 1.4.3-beta
Verify the GET /api/media/subtitles endpoint sanitizes inputs by testing with a non-admin account

References

Read the full report for CVE-2026-54910 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community