FileBrowser Quantum contains a path‑traversal flaw in its subtitle handler endpoint that allows an authenticated user to supply unvalidated 'path' and 'name' query parameters. Those parameters are used directly in filesystem operations, letting the attacker resolve arbitrary directories and read any text file that the server process can access, such as /etc/passwd, SSH keys, database credentials, or JWT signing keys. The weakness maps to CWE-22 and CWE-23 and results in unauthorized disclosure of potentially highly sensitive data.

The vulnerability affects any instance of FileBrowser Quantum running a version earlier than 1.4.3‑beta. The product is distributed by the gtsteffaniak community on GitHub, and users of older releases are exposed regardless of other security controls because the flaw exists in the publicly available source code prior to the patch.

The CVSS score of 7.7 indicates high impact. Because authentication is required, only users who already have legitimate access can exploit the flaw, yet such access is sufficient to read protected data. The EPSS score of less than 1% signals a very low probability of exploitation in the wild, but the lack of a KEV listing does not diminish the urgency of applying the fix. The attack vector is the authenticated API endpoint GET /api/media/subtitles, where an attacker can submit crafted 'path' and 'name' values to read arbitrary files.