Cloudanix VulnDB

GHSA-qqqm-5547-774x

Critical · 9.1

FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory

CVSS

9.1

EPSS

—

Published

May 22, 2026

CISA due date

—

The record

`publicPatchHandler` in `backend/http/public.go` joins user-controlled `fromPath` and `toPath` body fields with the trusted `d.share.Path` BEFORE the downstream sanitizer runs. Because `filepath.Join` collapses `..` segments during the join, the sanitizer in `resourcePatchHandler` never sees the traversal and the move/copy/rename operates on a path outside the shared directory. The same root-cause pattern was patched for the bulk DELETE endpoint as CVE-2026-44542 (GHSA-fwj3-42wh-8673), but the PATCH handler with the identical pattern was not updated. A public share link with `AllowModify=true` is sufficient to exploit this. Anyone holding such a link can move, copy, or rename arbitrary files within the share owner's source root. Verified on commit 869b640 (HEAD of `main` as of 2026-05-07).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities