CVE-2026-44542 FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion
Unauthenticated attackers with a valid share hash can delete arbitrary files outside the shared directory due to improper path sanitization.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44542?
CVE-2026-44542 is a critical path traversal vulnerability in gtsteffaniak filebrowser, published on 14 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta.
Weakness: CWE-22
Which versions are affected by CVE-2026-44542?
3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gtsteffaniak/filebrowser Go | All versions | 0.0.0-20260501183844-112740bdd41d |
github.com/gtsteffaniak/filebrowser Go | All versions | 0.0.0-20260501183844-112740bdd41d |
github.com/gtsteffaniak/filebrowser Go | All versions | 0.0.0-20260501183844-112740bdd41d |
Products include Gtsteffaniak Filebrowser Quantum.
How do I fix CVE-2026-44542?
Upgrade github.com/gtsteffaniak/filebrowser to 0.0.0-20260501183844-112740bdd41d or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44542 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44542 exists.
Other vulnerabilities in gtsteffaniak filebrowser
Sources
Also known as GHSA-fwj3-42wh-8673, GO-2026-5383.