FileBrowser Quantum allows an unauthenticated attacker to delete arbitrary files that lie outside the intended shared directory. The flaw results from attacker‑controlled path input being joined with a trusted base path before sanitization, enabling traversal sequences such as "../" to escape the public share’s directory. When a public share hash with delete permission is available, the attacker can target any file within the share owner’s configured storage scope, effectively erasing critical data and potentially disrupting service availability. The underlying weakness is a path‑traversal flaw, which jeopardizes data integrity and availability.

FileBrowser Quantum versions prior to 1.3.1‑stable and 1.3.9‑beta are impacted. The vulnerability applies to endpoints public/api/resources and public/api/resources/bulk, which process file deletion requests. Users running the affected releases should verify that a valid public share hash with delete permission is configured, as this is required for the exploit to succeed.

The CVSS score of 9.1 classifies this issue as critical. While EPSS data is unavailable, the absence of a KEV listing does not reduce its severity; the attack can be performed by an unauthenticated actor merely by possessing a public share hash, a scenario that frequently occurs when shares are publicly configurable. The vulnerability requires no authentication, only a share hash, and the required traversal is straightforward. Consequently, the risk to systems that host public shares with delete permission is high and remediation is urgent.