Gtsteffaniak vulnerabilities
We track 6 vulnerabilities in Gtsteffaniak products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Gtsteffaniak vulnerabilities
- 8.6 High severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1-beta, file read handling in backend/pkg/indexing/indexingFiles.go resolves symbolic links through GetRealPath without confirming that the resolved target remain
- 7.7 High severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem
- 8.7 High severity
filebrowser: Exposure of Sensitive Information to an Unauthorized Actor
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available.
- 9.3 Critical severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable, 1.4.0-beta and 1.4.1-beta are vulnerable to Path Traversal through the publicPatchHandler in backend/http/public.go which joins user-controlled fromPath and toP
- 9.1 Critical severity
filebrowser: Improper Limitation of a Pathname to a Restricted Directory
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9-beta, attacker-controlled path input is joined with a trusted base path prior to sanitization, allowing traversal sequences (e.g., ../) to escape the intended s
- 7.5 High severity
filebrowser: Missing Authentication for Critical Functionality
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, the remediation for CVE-2026-27611 is incomplete. Password protected shares still disclose tokenized downloadURL via /public/api/share/info. This vulnerab