Summary
FileBrowser Quantum contains a path validation weakness in file-read flows that follow symbolic links. A reachable symlink can resolve outside the source root and authorized scope, allowing an authenticated user or, in some public-share cases, an unauthenticated link holder to read server-accessible files.
FileBrowser Quantum contains a path validation weakness in file-read flows that follow symbolic links. A reachable symlink can resolve outside the source root and authorized scope, allowing an authenticated user or, in some public-share cases, an unauthenticated link holder to read server-accessible files.
Affected context
The issue occurs in deployments where FileBrowser Quantum enables symbolic-link following for download, preview, media, OnlyOffice, or public-share operations. Risk is higher when a reachable in-scope symlink points outside the configured source root or the requesting user's authorized directory, and when the target is readable by the server process.
The issue occurs in deployments where FileBrowser Quantum enables symbolic-link following for download, preview, media, OnlyOffice, or public-share operations. Risk is higher when a reachable in-scope symlink points outside the configured source root or the requesting user's authorized directory, and when the target is readable by the server process.
Exploit preconditions
- Attack surface: Web-based file-read endpoints and public-share read flows
- Required access: An authenticated account with download access, or a public-share link that exposes a suitable symlink
- Trigger point: A download, preview, media, OnlyOffice, or shared-file read operation with symbolic-link following enabled
- Why exploitation is possible: The resolved symbolic-link target is not consistently verified against both the source root and the user's authorized scope before content is served
- Attack surface: Web-based file-read endpoints and public-share read flows
- Required access: An authenticated account with download access, or a public-share link that exposes a suitable symlink
- Trigger point: A download, preview, media, OnlyOffice, or shared-file read operation with symbolic-link following enabled
- Why exploitation is possible: The resolved symbolic-link target is not consistently verified against both the source root and the user's authorized scope before content is served
Why this happens
The underlying bug is an insufficient path-containment check after symbolic-link resolution. The application obtains a real path but does not reliably confirm that the resulting target remains within the permitted root and authorization boundary.
This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with CWE-59: Improper Link Resolution Before File Access also describing the unsafe symbolic-link handling pattern. Trusting a user-reachable path without validating its canonical target can turn an apparently in-scope file request into an out-of-scope read.
The underlying bug is an insufficient path-containment check after symbolic-link resolution. The application obtains a real path but does not reliably confirm that the resulting target remains within the permitted root and authorization boundary.
This maps primarily to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, with CWE-59: Improper Link Resolution Before File Access also describing the unsafe symbolic-link handling pattern. Trusting a user-reachable path without validating its canonical target can turn an apparently in-scope file request into an out-of-scope read.
Potential impact
- An attacker may read files outside an assigned directory scope
- Sensitive configuration, credentials, or application data could be disclosed
- A public-share link could expose additional server-accessible files when its directory contains a suitable symlink
- The confidentiality of files on the host may be reduced
- Disclosed information could support further compromise or lateral movement
- An attacker may read files outside an assigned directory scope
- Sensitive configuration, credentials, or application data could be disclosed
- A public-share link could expose additional server-accessible files when its directory contains a suitable symlink
- The confidentiality of files on the host may be reduced
- Disclosed information could support further compromise or lateral movement
General mitigation guidance
Mitigation generally focuses on enforcing authorization against the canonical target path rather than only the user-supplied or displayed path.
Common defensive patterns include:
- Disable symbolic-link following by default unless the feature is explicitly required
- Resolve and validate canonical paths before every file-read operation
- Require the resolved target to remain within both the configured source root and the user's authorized scope
- Apply the same containment checks consistently across downloads, previews, media handlers, document integrations, and public shares
- Treat public-share paths as untrusted and avoid exposing links that can traverse outside the shared directory
- Run the service with least-privilege filesystem permissions and limit access to sensitive host paths
Mitigation generally focuses on enforcing authorization against the canonical target path rather than only the user-supplied or displayed path.
Common defensive patterns include:
- Disable symbolic-link following by default unless the feature is explicitly required
- Resolve and validate canonical paths before every file-read operation
- Require the resolved target to remain within both the configured source root and the user's authorized scope
- Apply the same containment checks consistently across downloads, previews, media handlers, document integrations, and public shares
- Treat public-share paths as untrusted and avoid exposing links that can traverse outside the shared directory
- Run the service with least-privilege filesystem permissions and limit access to sensitive host paths
How teams detect issues like this
Organizations can look for:
- Static analysis rules identifying file access performed after symlink resolution without an explicit containment check
- Code review signals such as path authorization performed before canonicalization, or checks applied only to selected read handlers
- Tests that verify symlink targets outside source roots and user scopes are rejected across every file-serving flow
- Runtime logging and policy enforcement for file reads that resolve outside approved directory boundaries
- Automated security review tools that flag link-following APIs and incomplete canonical-path validation
Organizations can look for:
- Static analysis rules identifying file access performed after symlink resolution without an explicit containment check
- Code review signals such as path authorization performed before canonicalization, or checks applied only to selected read handlers
- Tests that verify symlink targets outside source roots and user scopes are rejected across every file-serving flow
- Runtime logging and policy enforcement for file reads that resolve outside approved directory boundaries
- Automated security review tools that flag link-following APIs and incomplete canonical-path validation
