Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
Warning: Critical Path Traversal vulnerability in #FileBrowser Quantum. CVE-2026-48777 CVSS:9.3 CVE-2026-44542 CVSS: 9.1. This can lead to unauthorized access to arbitrary files. #Patch #Patch #Patch
Post summary
The text announces two high‑CVSS path‑traversal CVEs for FileBrowser Quantum, noting the risk of arbitrary file access, but provides no PoC, active exploitation evidence, or patch details.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gtsteffaniak | filebrowser_quantum | - | - | - |
| App | gtsteffaniak | filebrowser_quantum | - | - | - |