FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Summary

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Why it matters

GitHub has published a reviewed security advisory for github.com/gtsteffaniak/filebrowser/backend. Prioritize it with other application dependency updates, especially because EPSS places it in the 23% percentile.

Operator check

Check whether github.com/gtsteffaniak/filebrowser/backend is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available. EPSS probability: 0.3%; percentile: 23%.

Sources