CVE-2026-44542

{
  "id": "CVE-2026-44542",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T18:16:50.157",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner’s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta."
    },
    {
      "lang": "es",
      "value": "FileBrowser Quantum es un gestor de archivos gratuito, autoalojado y basado en web. Antes de 1.3.1-stable y 1.3.9-beta, la entrada de ruta controlada por el atacante se une con una ruta base de confianza antes de la sanitización, permitiendo que las secuencias de recorrido (p. ej., .. / ) escapen del directorio compartido previsto. Como resultado, un atacante no autenticado que posea un hash de recurso compartido público válido con permisos de eliminación habilitados puede eliminar archivos arbitrarios fuera del directorio compartido dentro del ámbito de almacenamiento configurado del propietario del recurso compartido. Esto afecta a public/API/resources y public/API/resources/bulk. Esta vulnerabilidad está corregida en 1.3.1-stable y 1.3.9-beta."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "gtsteffaniak",
          "product": "filebrowser",
          "versions": [
            {
              "version": "< 1.3.1-stable",
              "status": "affected"
            },
            {
              "version": "< 1.3.9-beta",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T15:00:31.691150Z",
          "id": "CVE-2026-44542",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:-:*:*:*:*:*:*",
              "versionEndExcluding": "1.3.1",
              "matchCriteriaId": "95D2BC81-03F2-4413-8BDD-91D0AB66FD94"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:beta:*:*:*:*:*:*",
              "versionEndExcluding": "1.3.9",
              "matchCriteriaId": "6DBAB5E5-3ABA-4480-A819-E69FECB25E8F"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}