CVE-2026-44542

{"id": "CVE-2026-44542", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44542", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-15T15:00:31.691150Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "gtsteffaniak", "product": "filebrowser", "versions": [{"status": "affected", "version": "< 1.3.1-stable"}, {"status": "affected", "version": "< 1.3.9-beta"}]}]}], "published": "2026-05-14T18:16:50.157", "references": [{"url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-fwj3-42wh-8673", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended shared directory. As a result, an unauthenticated attacker possessing a valid public share hash with delete permissions enabled can delete arbitrary files outside the shared directory within the share owner\u2019s configured storage scope. This affects public/api/resources and public/api/resources/bulk. This vulnerability is fixed in 1.3.1-stable and 1.3.9-beta."}, {"lang": "es", "value": "FileBrowser Quantum es un gestor de archivos gratuito, autoalojado y basado en web. Antes de 1.3.1-stable y 1.3.9-beta, la entrada de ruta controlada por el atacante se une con una ruta base de confianza antes de la sanitizaci\u00f3n, permitiendo que las secuencias de recorrido (p. ej., .. / ) escapen del directorio compartido previsto. Como resultado, un atacante no autenticado que posea un hash de recurso compartido p\u00fablico v\u00e1lido con permisos de eliminaci\u00f3n habilitados puede eliminar archivos arbitrarios fuera del directorio compartido dentro del \u00e1mbito de almacenamiento configurado del propietario del recurso compartido. Esto afecta a public/API/resources y public/API/resources/bulk. Esta vulnerabilidad est\u00e1 corregida en 1.3.1-stable y 1.3.9-beta."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "95D2BC81-03F2-4413-8BDD-91D0AB66FD94", "versionEndExcluding": "1.3.1"}, {"criteria": "cpe:2.3:a:gtsteffaniak:filebrowser_quantum:*:beta:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DBAB5E5-3ABA-4480-A819-E69FECB25E8F", "versionEndExcluding": "1.3.9"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}