CVE-2026-48777: Critical Path Traversal in FileBrowser Quantum Actively Weaponized

Overview

CVE-2026-48777 is a Critical-severity path traversal vulnerability (CWE-22) affecting FileBrowser Quantum, a free, self-hosted, web-based file manager. The flaw exists in all versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta. It was first published on June 16, 2026, and carries a CVSS 4.0 base score of 9.3 (CRITICAL).

Technical Details

The vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. By crafting malicious file paths in requests to the FileBrowser Quantum web interface, an attacker can escape the intended directory boundary and access or overwrite files anywhere on the underlying host filesystem.

The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N tells a stark story:

• Network-accessible attack vector (AV:N): Exploitation requires no physical or local access — any internet-exposed instance is in scope.
• Low attack complexity (AC:L): No special conditions, race conditions, or target-specific configurations are required.
• No privileges required (PR:N): The attacker does not need an account or any prior authentication on the target system.
• No user interaction (UI:N): Exploitation is fully attacker-driven; no victim action is needed.
• High confidentiality and integrity impact (VC:H / VI:H): Successful exploitation grants both unauthorized read and write access to files on the host.

The combination of zero authentication, zero user interaction, and network reachability makes this one of the most exploitable vulnerability profiles possible.

Exploit and Threat Status

This vulnerability carries an exploit maturity rating of "weaponized," meaning a functional, ready-to-use exploit is already in circulation. Notably, exploit activity was recorded on the same day the CVE was published — June 16, 2026 — indicating essentially zero lag between disclosure and active exploitation. While this CVE has not yet been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, the weaponized status and same-day exploitation timeline demand immediate attention from defenders. No threat actor group has been formally attributed to active exploitation at this time.

Affected Versions

• FileBrowser Quantum versions prior to 1.3.2-stable
• FileBrowser Quantum versions prior to 1.4.0-beta
• FileBrowser Quantum versions prior to 1.4.1-beta

Remediation Guidance

No official patch has been confirmed at the time of this writing. However, the GitHub releases page for the project references version v1.3.3-stable, which may contain the relevant fix — organizations should review the release notes for v1.3.3-stable and apply this update immediately if applicable.

Until a fully confirmed patch is applied, the following mitigations are strongly recommended:

• Take internet-exposed instances offline or place them behind a VPN or authenticated reverse proxy immediately.
• Restrict network access using firewall rules, so only trusted IP ranges can reach the FileBrowser Quantum interface.
• Audit filesystem activity on any host running FileBrowser Quantum for signs of unauthorized file access or modification.
• Monitor for exploit attempts by reviewing web server logs for path traversal patterns (e.g., ../ sequences in request paths).
• Apply least-privilege principles to the process account running FileBrowser Quantum to limit the blast radius of any successful exploitation.

Stay Informed

The weaponized status of CVE-2026-48777 and its zero-authentication, network-reachable attack surface make it a top priority for any organization running self-hosted FileBrowser Quantum instances. Track this CVE and monitor emerging vulnerabilities across your attack surface at sec.kaitan.id.