CVE-2026-54910: Multiple Path Traversal Vulnerabilities in FileBrowser Quantum Subtitle Handler

FileBrowser Quantum is a web-based file management application. It allows users to manage local directories, stream media, and modify system files through a web interface. The application exposes several API endpoints to handle media content. One such endpoint is GET /api/media/subtitles, handled by the subtitlesHandler function in backend/http/media.go.

This endpoint is designed to allow users to retrieve sidecar subtitles (such as SRT or VTT files) for video streams. It processes user-supplied query parameters to identify the video file and fetch the associated subtitle. However, the handler does not perform adequate input validation on these query parameters.

This lack of validation introduces a directory traversal vulnerability classified under CWE-22. Any authenticated user can exploit this vulnerability to read arbitrary text files on the host operating system. The scope of the vulnerability extends beyond the application root because the underlying file-reading mechanisms run with the privileges of the FileBrowser Quantum process.

The root cause lies in the logical flow of the subtitlesHandler endpoint. The endpoint reads four parameters: path, source, name, and embedded. The source parameter dictates the user scope under which the directory queries must run. However, the application fails to confine the path operations to this scope when resolving the inputs.

There are two independent path traversal vectors in the vulnerable handler. The first vector is via the path parameter. The application fetches the path string and passes it directly to the indexing engine via idx.GetRealPath(userscope, path). The indexing engine fails to sanitize this parameter using safe path-handling primitives, allowing directory traversal sequences like .. to resolve outside the defined user scope directory.

The second vector exists in the handling of the name parameter. Even if the path parameter points to a valid file inside the scope, the application resolves its parent directory and appends the name parameter using Go's standard filepath.Join(parentDir, name). While filepath.Join cleans the final string, it does not prevent traversing above the parentDir if relative paths are provided in name. This allows an attacker to fetch any file by appending traversal strings to the name parameter.

To understand the technical mechanism, we must analyze the vulnerable implementation of the subtitlesHandler function in backend/http/media.go. The following code snippet demonstrates the unsafe retrieval and manipulation of query parameters:

// Vulnerable code in backend/http/media.go
path := r.URL.Query().Get("path")
source := r.URL.Query().Get("source")
name := r.URL.Query().Get("name")
 
userscope, err := d.user.GetScopeForSourceName(source)
// ...
idx := indexing.GetIndex(source)
// ...
realPath, _, err := idx.GetRealPath(userscope, path)
// ...
parentDir := filepath.Dir(realPath)
 
if !embedded {
    // UNSAFE: name is concatenated without validation
    content, err = utils.GetSubtitleSidecarContent(filepath.Join(parentDir, name))
}

In this implementation, idx.GetRealPath returns an unsanitized absolute path based on user input. Following this, filepath.Join constructs the file path using the untrusted name parameter. There are no checks to ensure that the constructed path remains within the bounds of parentDir or the defined userscope storage root.

// Patched code in backend/http/media.go (Commit f3f4bbe8)
fileInfo, err := files.FileInfoFaster(utils.FileOptions{
    FollowSymlinks:           true,
    Path:                     path,
    Source:                   source,
    Expand:                   true,
    Content:                  false,
    Metadata:                 true,
    ExtractEmbeddedSubtitles: config.Integrations.Media.ExtractEmbeddedSubtitles,
    // ...
}, store.Access, d.user, store.Share)
 
if !strings.HasPrefix(fileInfo.Type, "video") {
    return http.StatusNotFound, fmt.Errorf("file is not a video")
}
 
track := findSubtitleTrack(fileInfo.Subtitles, name, embedded)
// ...
if !embedded {
    // SECURE: filepath.Base strips directory traversal sequences from track.Name
    subtitlePath := filepath.Join(filepath.Dir(fileInfo.RealPath), filepath.Base(track.Name))
    content, err = utils.GetSubtitleSidecarContent(subtitlePath)
}

The patched version introduces three key security enhancements. First, path resolution is delegated to files.FileInfoFaster, which uses the central, scope-aware file resolver. Second, the code validates that the target file is a video, preventing direct access to non-video configuration files. Third, it applies filepath.Base to the subtitle track name, which strips all directory traversal segments before joining it to the video's parent directory.

An attacker can exploit either path traversal vector using a standard web browser or command-line utility. The attacker must possess valid credentials to authenticate to the FileBrowser Quantum instance and obtain an active JSON Web Token (JWT) or session cookie.

In the first exploitation scenario, the attacker targets the path parameter directly. The attacker constructs an HTTP GET request to /api/media/subtitles and populates the path parameter with traversal sequences. For example, setting path=/../../../../etc/passwd allows the attacker to traverse to the root directory. Setting the name parameter to passwd matches the final path construction logic, prompting the server to read and return /etc/passwd:

GET /api/media/subtitles?source=default&path=/../../../../etc/passwd&name=passwd&embedded=false HTTP/1.1
Host: target-filebrowser.local
Authorization: Bearer <JWT_TOKEN>

In the second exploitation scenario, the attacker leverages the name parameter traversal vulnerability. The attacker selects an existing, valid video file within their scoped directory to satisfy the initial path check. The attacker then implements the traversal sequences directly in the name parameter. The application resolves the valid video directory and appends the malicious name argument, resolving to the targeted file:

GET /api/media/subtitles?source=default&path=movies/clip.mp4&name=../../../../etc/passwd&embedded=false HTTP/1.1
Host: target-filebrowser.local
Authorization: Bearer <JWT_TOKEN>

The impact of successful exploitation is critical. Although the vulnerability requires authentication, FileBrowser Quantum is frequently deployed in multi-tenant environments where standard users are intended to have restricted directory access. An attacker with a low-privileged account can read arbitrary system text files, effectively breaking tenant isolation.

By accessing arbitrary host files, an attacker can extract sensitive system information. This includes reading /etc/passwd to map user accounts, accessing application configuration files to retrieve database credentials, or reading private SSH keys from user home directories. Additionally, if the attacker retrieves the server's private JWT signing key, they can forge administrative session tokens and gain full control over the application.

The vulnerability is classified as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, yielding a base score of 7.7. The scope is marked as 'Changed' (S:C) because the traversal allows the attacker to read files directly from the host operating system, escaping the application's logical directory restrictions.

The primary remediation strategy is upgrading FileBrowser Quantum to version 1.4.3-beta or higher. The update introduces robust authorization logic, file-type checks, and path normalization to effectively neutralize traversal attacks. This version can be downloaded from the official repository release page.

If upgrading is not immediately feasible, system administrators should implement containerization or operating system-level process isolation. Running FileBrowser Quantum inside a minimal Docker container limits host file exposure. The application container should execute with non-root privileges and map only necessary data directories, preventing access to host files like /etc/passwd or ssh keys.

Administrators can detect exploitation attempts by monitoring application access logs for anomalous GET requests. Requests to /api/media/subtitles containing .. or %2f sequences in either the path or name query parameters are high-fidelity indicators of exploitation. Additionally, deployment of a web application firewall (WAF) or an intrusion detection system (IDS) can block incoming requests containing common traversal patterns.