https://vulnerability.circl.lu/sightings/feed 2026-08-05T05:04:45.243709+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/019b8c11-3fca-4bda-abe8-4b05200edec0/export 2026-08-05T05:04:45.269094+00:00 Joseph Lee https://cve.circl.lu/user/syspect {"uuid": "019b8c11-3fca-4bda-abe8-4b05200edec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-54910", "type": "published-proof-of-concept", "source": "https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w", "content": "", "creation_timestamp": "2026-08-01T00:35:03.865056Z"} 2026-08-01T00:35:03.865056+00:00 https://vulnerability.circl.lu/sighting/dea069c6-83d9-4921-88d7-3e08a13a4c8b/export 2026-08-05T05:04:45.272704+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dea069c6-83d9-4921-88d7-3e08a13a4c8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54910", "type": "seen", "source": "https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f", "content": "# CVE-2026-54910: CVE-2026-54910: Multiple Path Traversal Vulnerabilities in FileBrowser Quantum Subtitle Handler\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54910\n\n## Summary\nFileBrowser Quantum (a fork of Filebrowser) prior to version 1.4.3-beta is vulnerable to multiple directory traversal flaws in its subtitle handler endpoint (`GET /api/media/subtitles`). This allows authenticated users with standard access to read arbitrary text files on the host system.\n\n## TL;DR\nAuthenticated path traversal in FileBrowser Quantum subtitle handler allows reading arbitrary system files via unvalidated query parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00307\n- **Impact**: Arbitrary File Read\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- FileBrowser Quantum\n- **FileBrowser Quantum**: < 1.4.3-beta (Fixed in: `1.4.3-beta`)\n\n## Mitigation\n\n- Upgrade to v1.4.3-beta or higher\n- Run application as a non-privileged user\n- Apply strict container-level or chroot isolation\n\n**Remediation Steps:**\n1. Identify running instances of FileBrowser Quantum\n2. Pull and deploy the patched image or binary for version 1.4.3-beta\n3. Verify the GET /api/media/subtitles endpoint sanitizes inputs by testing with a non-admin account\n\n## References\n\n- [GitHub Security Advisory GHSA-vvp7-h4fj-m28w](https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w)\n- [Fix Patch Commit f3f4bbe](https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a)\n- [Pull Request #2524](https://github.com/gtsteffaniak/filebrowser/pull/2524)\n- [FileBrowser Quantum v1.4.3-beta Release](https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.3-beta)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54910)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-54910)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54910) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-01T00:00:16.049048Z"} 2026-08-01T00:00:16.049048+00:00 https://vulnerability.circl.lu/sighting/615a5ed9-a19f-4c30-8d3c-a9351fb4c9c4/export 2026-08-05T05:04:45.274967+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "615a5ed9-a19f-4c30-8d3c-a9351fb4c9c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54910", "type": "seen", "source": "https://gist.github.com/alon710/9fa87dd82b0216d33fe7579c4687415f", "content": "# CVE-2026-54910: CVE-2026-54910: Multiple Path Traversal Vulnerabilities in FileBrowser Quantum Subtitle Handler\n\n> **CVSS Score:** 7.7\n> **Published:** 2026-07-31\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54910\n\n## Summary\nFileBrowser Quantum (a fork of Filebrowser) prior to version 1.4.3-beta is vulnerable to multiple directory traversal flaws in its subtitle handler endpoint (`GET /api/media/subtitles`). This allows authenticated users with standard access to read arbitrary text files on the host system.\n\n## TL;DR\nAuthenticated path traversal in FileBrowser Quantum subtitle handler allows reading arbitrary system files via unvalidated query parameters.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22\n- **Attack Vector**: Network\n- **CVSS Score**: 7.7\n- **EPSS Score**: 0.00307\n- **Impact**: Arbitrary File Read\n- **Exploit Status**: poc\n- **KEV Status**: No\n\n## Affected Systems\n\n- FileBrowser Quantum\n- **FileBrowser Quantum**: < 1.4.3-beta (Fixed in: `1.4.3-beta`)\n\n## Mitigation\n\n- Upgrade to v1.4.3-beta or higher\n- Run application as a non-privileged user\n- Apply strict container-level or chroot isolation\n\n**Remediation Steps:**\n1. Identify running instances of FileBrowser Quantum\n2. Pull and deploy the patched image or binary for version 1.4.3-beta\n3. Verify the GET /api/media/subtitles endpoint sanitizes inputs by testing with a non-admin account\n\n## References\n\n- [GitHub Security Advisory GHSA-vvp7-h4fj-m28w](https://github.com/gtsteffaniak/filebrowser/security/advisories/GHSA-vvp7-h4fj-m28w)\n- [Fix Patch Commit f3f4bbe](https://github.com/gtsteffaniak/filebrowser/commit/f3f4bbe80cb569d664174aea874d7bfa008c3b5a)\n- [Pull Request #2524](https://github.com/gtsteffaniak/filebrowser/pull/2524)\n- [FileBrowser Quantum v1.4.3-beta Release](https://github.com/gtsteffaniak/filebrowser/releases/tag/v1.4.3-beta)\n- [National Vulnerability Database Entry](https://nvd.nist.gov/vuln/detail/CVE-2026-54910)\n- [CVE.org Authority Record](https://www.cve.org/CVERecord?id=CVE-2026-54910)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54910) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-31T23:31:28.511183Z"} 2026-07-31T23:31:28.511183+00:00 https://vulnerability.circl.lu/sighting/34dd6548-56cb-4268-b1db-42f42cf1221b/export 2026-08-05T05:04:45.275131+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "34dd6548-56cb-4268-b1db-42f42cf1221b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-54910", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mr3o2yb6fc2m", "content": "\ud83d\udfe0 CVE-2026-54910 - High (7.7)\n\nFileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-54910/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-20T16:00:39.643991Z"} 2026-07-20T16:00:39.643991+00:00