CVE-2026-54910: FileBrowser Quantum Path Traversal Vulnerability Allows Authenticated Users to Read Arbitrary Files
A critical path traversal vulnerability, CVE-2026-54910, has been discovered in FileBrowser Quantum's subtitle handler. This flaw allows any authenticated user to read arbitrary files on the host filesystem, including sensitive files such as /etc/passwd, SSH keys, and database credentials. The vulnerability is caused by the lack of sanitization in the `path` and `name` parameters used in filesystem operations. Immediate patching is recommended to prevent potential exploitation.