CVE-2026-48777

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-48777
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48777.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-48777
Aliases
Downstream
Related
Published
2026-06-16T18:40:06Z
Modified
2026-08-12T03:51:47Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory
Details

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toPath body fields with the trusted d.share.Path BEFORE the downstream sanitizer runs. Because filepath.Join collapses .. segments during the join, the sanitizer in resourcePatchHandler never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with AllowModify=true is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. This issue has been fixed in versions 1.3.3-stable and 1.4.2-beta.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48777.json"
}
References

Affected packages

Git / github.com/gtsteffaniak/filebrowser

Affected ranges

Type
GIT
Repo
https://github.com/gtsteffaniak/filebrowser
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
a6deb9b8abd1a6b977723a78fe6103844cca7773
Fixed
28e9b81e438e65e1af2979d4a7e66f1a433fe720
Fixed
6a997d4605469dea820c72294b0be1049eadc61c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.3-stable"
        },
        {
            "introduced": "1.4.0-beta"
        },
        {
            "fixed": "1.4.2-beta"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.3.4
v0.3.6-beta
v0.3.7-beta
v0.4.0-beta
v0.4.1-beta
v0.4.2-beta
v0.5.0-beta
v0.5.1-beta
v0.5.2-beta
v0.7.6-beta
v1.*
v1.0.1-stable
v1.2.1-stable
v1.3.1-stable
v1.3.2-stable
v1.3.9-beta

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-48777.json"