{"uuid": "dea069c6-83d9-4921-88d7-3e08a13a4c8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54910", "type": "seen", "source": "https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f", "content": "# CVE-2026-54910: CVE-2026-54910: Multiple Path Traversal Vulnerabilities in FileBrowser Quantum Subtitle Handler\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54910\n\n## Summary\nFileBrowser Quantum (a fork of Filebrowser) prior to version 1.4.3-beta is vulnerable to multiple directory traversal flaws in its subtitle handler endpoint (`GET /api/media/subtitles`). This allows authenticated users with standard access to read arbitrary text files on the host system.\n\n## TL;DR\nAuthenticated path traversal in FileBrowser Quantum subtitle handler allows reading arbitrary system files via unvalidated query parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00307\n- **Impact**: Arbitrary File Read\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- FileBrowser Quantum\n- **FileBrowser Quantum**: < 1.4.3-beta (Fixed in: `1.4.3-beta`)\n\n## Mitigation\n\n- Upgrade to v1.4.3-beta or higher\n- Run application as a non-privileged user\n- Apply strict container-level or chroot isolation\n\n**Remediation Steps:**\n1. Identify running instances of FileBrowser Quantum\n2. Pull and deploy the patched image or binary for version 1.4.3-beta\n3. Verify the GET /api/media/subtitles endpoint sanitizes inputs by testing with a non-admin account\n\n## References\n\n- [GitHub Security Advisory GHSA-vvp7-h4fj-m28w](https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w)\n- [Fix Patch Commit f3f4bbe](https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a)\n- [Pull Request #2524](https://github.com/gtsteffaniak/filebrowser/pull/2524)\n- [FileBrowser Quantum v1.4.3-beta Release](https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.3-beta)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54910)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-54910)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54910) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:00:16.049048Z"}