FileBrowser Quantum has a flaw in how it resolves symbolic links during file retrieval. The backend does not verify that a resolved target remains within the user's authorized root, allowing a freely reachable in-scope symlink to point to files outside that scope. The result is that any user who can download from the web interface, or any recipient of a public share link that exposes such a link, can read server files that should be inaccessible, leading to confidential data disclosure.

The vulnerability exists in the gtsteffaniak:filebrowser product, specifically all releases prior to v1.5.2‑stable on the stable branch and prior to v2.0.1‑beta on the beta branch. Any instance running one of those older versions is affected.

The CVSS score of 8.6 categorizes the issue as high. No EPSS score is available, so contemporary exploitation probability is unknown, and the vulnerability is not listed in CISA’s KEV catalog. Attackers would need to be authenticated with download privileges or have a public share link to the directory containing an outward‑pointing symlink. Once that condition is met, reading is immediate and does not require additional privileges, making the risk significant for exposed deployments.