UNKNOWN Go
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend
GO-2026-6164 · CVE-2026-54910 · GHSA-vvp7-h4fj-m28w
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files in github.com/gtsteffaniak/filebrowser/backend
References
- ADVISORY https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-54910
- WEB https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a
- WEB https://github.com/gtsteffaniak/filebrowser/pull/2524
- WEB https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.3-beta
Ready to move
Start Securing
Free, no credit card | First findings in minutes