HIGH 7.7 GitHub
CVE-2026-54910
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
### Summary
The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.
The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anch
Affected Products
- go/github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260608182036-f3f4bbe80cb5
References
- https://github.com/advisories/GHSA-vvp7-h4fj-m28w
- https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w
- https://nvd.nist.gov/vuln/detail/CVE-2026-54910
- https://github.com/gtsteffaniak/filebrowser/pull/2524
This high severity vulnerability with a CVSS score of 7.7 was published on 2026-07-31 via GitHub. Affected: go/github.com/gtsteffaniak/filebrowser/backend < 0.0.0-20260608182036-f3f4bbe80cb5.
vulnfeed aggregates 9166 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.