Zero Radar
← feed
HighVulnerabilityCVE-2026-116682updated 27 Oct 2026, 21:05 UTC

FileBrowser Quantum lets users read server files outside their folder via symlinks

A symbolic link (a shortcut to another file) inside a user's folder can point to a file elsewhere on the server. FileBrowser follows that shortcut and shows the file, even when the user should not be able to see it.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes1.5.2-stable, 2.0.1-beta, go/github.com/gtsteffaniak/filebrowser/backend 0.0.0-20260814233832-4126edeb07a0 · since 27 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Authenticated userHas download access to own folder
  2. 2Symlink in scopePoints to a file outside the folder
  3. 3Symlink followedEvalSymlinks resolves target without scope check
  4. 4Out-of-scope file reade.g. /etc/passwd or SSH keys
  5. ResultServer files exposed to the user

What happened

Read paths (download, preview, media, OnlyOffice, public share) resolve symlinks with filepath.EvalSymlinks and never check that the target stays inside the user's scope root, enabling path traversal to arbitrary server-readable files.

Why it is dangerous: Any authenticated user with download access can read files the server process can reach, such as /etc/passwd or SSH keys. Anyone holding a public share link can do the same without an account if the shared folder contains such a symlink.

Are you affected?

You are affected if you run FileBrowser Quantum before 1.5.2-stable or 2.0.1-beta (or the Go backend before 0.0.0-20260814233832-4126edeb07a0) and have FollowSymlinks enabled on read flows, or public shares that expose folders with symlinks.

Package / productAffected versionsFixed in
github.com/gtsteffaniak/filebrowser/backend · go< 0.0.0-20260814233832-4126edeb07a00.0.0-20260814233832-4126edeb07a0

What to do

  1. Update FileBrowser Quantum to 1.5.2-stable or 2.0.1-beta, or the backend module to 0.0.0-20260814233832-4126edeb07a0 or later
  2. Review existing shared folders and user folders for symbolic links pointing outside the intended scope and remove them if unneeded
  3. Disable public shares of folders that contain symlinks until the update is applied

Timeline

  1. 27 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 27 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 27 Oct 2026, 18:20 UTC
    Picked up by Zero Radar
  4. 27 Oct 2026, 21:05 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 27 Oct 2026, 21:05 UTC
    Fixed version published: github.com/gtsteffaniak/filebrowser/backend 0.0.0-20260814233832-4126edeb07a0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116682 · GHSA-mgqf-5mf5-prfj
CVSS
8.6 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
27 Oct 2026, 18:17 UTC
On Zero Radar
27 Oct 2026, 18:20 UTC (3 min after disclosure)
Last change
27 Oct 2026, 21:05 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

FileBrowser Quantum lets users read server files outside their folder via symlinks · Zero Radar