CVE-2026-48777: FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory

Synopsis

A path traversal vulnerability exists in FileBrowser Quantum's public share PATCH endpoint (publicPatchHandler). The flaw is reachable over the network with no authentication required, only a valid public share link with modification enabled is needed. Successful exploitation lets an attacker move, copy, or rename arbitrary files anywhere within the share owner's source root, bypassing the intended directory boundary. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment fix versions are published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable PATCH endpoint is exposed over the network, so an attacker must be able to reach the FileBrowser Quantum instance via HTTP/HTTPS.

• AuthenticationNot required

  No account or credential is needed; possession of a public share link with AllowModify=true is sufficient to trigger the exploit.

• Victim interactionNot required

  The attacker submits a crafted PATCH request directly and no action from any other user is required.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the path traversal works deterministically because filepath.Join collapses dot-dot segments before the sanitizer runs.

Blast Radius

• Attacker moves, copies, or renames files outside the intended shared directory and into any path accessible within the share owner's source root.
• File system layout for the share owner can be silently altered, overwriting existing files with attacker-controlled content via a rename or copy operation.
• Sensitive files stored elsewhere in the source root (configuration files, credentials, private documents) can be relocated to a publicly readable location and subsequently downloaded.