FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the "subtitlesHandler" endpoint ("GET /api/media/subtitles") accepts two user-controlled query parameters: "path" and "name", both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the "path" parameter: it is passed directly to "idx.GetRealPath()" without calling "SanitizeUserPath()", allowing an attacker to escape the storage root and set "parentDir" to any directory on the host. No existing anchor file is required. The secondary vector is the "name" parameter: it is joined with "parentDir" via "filepath.Join(parentDir, name)" without stripping directory components, allowing traversal relative to any resolved "parentDir". Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including "/etc/passwd", SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue.