Critical FileBrowser Quantum Flaw (CVE-2026-46410) Exposes Files to Anonymous Users

A newly disclosed critical vulnerability in FileBrowser Quantum, a popular self-hosted web file manager, allows completely unauthenticated attackers to expose sensitive source and path information without ever logging in.

Tracked as CVE-2026-46410 and published under GHSA-3jmg-p96m-m328, the flaw was disclosed by project maintainer gtsteffaniak on May 14 and carries a CVSS 4.0 score of 8.7, placing it firmly in critical territory.

The vulnerability stems from improper access controls on FileBrowser Quantum’s share functionality, classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical FileBrowser Quantum Flaw

Because the flaw affects the underlying HTTP handling logic in the Go-based application, any remote party who can simply reach the exposed web interface can retrieve file source identifiers and path metadata that should be strictly limited to authenticated sessions.

No credentials, special configuration, or user interaction are required, and the attack complexity is rated low, meaning even unsophisticated actors could exploit it at scale against internet-facing instances.

FileBrowser Quantum is a major fork of the original FileBrowser project, built as an enhanced self-hosted file manager for individuals and organizations wanting browser-based control over their storage.

Every version at or below 1.3.1-stable and 1.4.0-beta is vulnerable, meaning a large swath of self-hosted deployments running default configurations were exposed the moment this issue became public knowledge.

While the leaked data file source and path strings may sound modest compared to a full data breach, security researchers warn it can serve as reconnaissance fuel for more damaging follow-up attacks, including directory traversal or targeted file-read exploitation against the same instance.github+2

“Metadata leaks like this rarely make headlines on their own, but they’re the reconnaissance layer attackers love knowing exactly where files live on a target system turns a blind guess into a surgical strike. Treat any ‘info disclosure only’ CVE with the same urgency as a direct compromise, because it’s often the first domino.”

Unlike many vulnerabilities that offer interim mitigations, the vendor advisory is blunt: there are no workarounds available for CVE-2026-46410. The only remediation path is upgrading directly to the patched releases 1.3.2-stable or 1.4.1-beta, both of which incorporate the fix delivered in commit 1802e128.

Administrators running unpatched instances exposed to the public internet should consider temporarily restricting network access via firewall rules while patching is completed.

This is not FileBrowser Quantum’s only recent brush with information disclosure. Just months earlier, CVE-2026-28492 a related but distinct path traversal flaw in the public share-link middleware allowed anyone holding a share link to browse sibling directories beyond the intended scope, a bug fixed in version 2.61.0 under a separate advisory.

Together, these disclosures highlight a recurring weak point in the project’s share and access-control logic, underscoring why organizations running self-hosted file managers should treat share functionality as a persistent audit priority rather than a “set and forget” feature.

Upgrade immediately to FileBrowser Quantum 1.3.2-stable or 1.4.1-beta, since no workaround exists.
Audit existing public share links and cross-check accessed paths against intended scope for signs of prior abuse.
Restrict direct internet exposure of self-hosted instances via firewall or reverse-proxy access controls until patched.
Review access logs for anomalous, unauthenticated requests to share endpoints predating the patch.