CVE-2026-54910 FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files
Authenticated users can read arbitrary files on the server via path traversal in the subtitle handler, exposing sensitive data like credentials and keys.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54910?
CVE-2026-54910 is a high-severity path traversal vulnerability in gtsteffaniak filebrowser, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.
Which versions are affected by CVE-2026-54910?
3 open source packages ship an affected version, including github.com/gtsteffaniak/filebrowser/backend.
| Package | Affected | Fixed in |
|---|---|---|
github.com/gtsteffaniak/filebrowser/backend Go | All versions | 0.0.0-20260608182036-f3f4bbe80cb5 |
github.com/gtsteffaniak/filebrowser/backend Go | All versions | 0.0.0-20260608182036-f3f4bbe80cb5 |
github.com/gtsteffaniak/filebrowser/backend Go | All versions | 0.0.0-20260608182036-f3f4bbe80cb5 |
How do I fix CVE-2026-54910?
Upgrade github.com/gtsteffaniak/filebrowser/backend to 0.0.0-20260608182036-f3f4bbe80cb5 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-54910 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54910 exists.
Sources
Also known as GHSA-vvp7-h4fj-m28w, GO-2026-6164.