# Tenjin Security Briefs – FileBrowser Subtitle Endpoint Path Traversal Advisory

> Tenjin Security Briefs – FileBrowser Subtitle Endpoint Path Traversal Advisory is a paid API for AI agents from tenjin.blog, paid per call via x402, $0.1/call, status unknown (last checked 2026-09-15).

Returns the full text of a paid security brief article about FileBrowser Quantum's subtitle handler path-traversal vulnerability (CVE advisory dated July 31)

## Facts

- Endpoint: GET https://tenjin.blog/api/read/security-briefs/security-briefs-daily-filebrowser-s-subtitle-endpoint-crossed-the-storage-root
- Price: $0.1/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-15
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/tenjin-security-briefs-filebrowser-subtitle-endpoint-path-traversal-f76a17e4
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_BIq4moU1iNX7hQ54nN-9e

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability tenjin-security-briefs-filebrowser-subtitle-endpoint-path-traversal-f76a17e4
```

Example prompt: Pull the Tenjin security brief on FileBrowser Quantum's subtitle endpoint path traversal vulnerability — the one from July 31 that covers affected versions 1.3.3-stable and 1.4.2-beta and the fix in v1.4.3-beta.

## When to prefer this

Use this endpoint when you specifically need the full text of the FileBrowser Quantum subtitle handler path traversal advisory from Tenjin's security briefs feed. Prefer this over generic web search when you need the structured, paid-access article with complete vulnerability details, affected versions, and fix guidance in a single deterministic fetch.

## Known failure modes

- Incorrect or missing handle/slug path params returns 404 article not found
- Payment failure via x402 protocol prevents content delivery
- Slug 'latest' used with handle 'latest' is not payable and will fail
- Article may have been updated or replaced since crawl; content could differ
- Network timeout or upstream blog unavailability returns 5xx error

## How this service works

FileBrowser Quantum's July 31 reviewed advisory says any authenticated user could use the subtitle handler to read host text files outside their storage scope; affected versions include 1.3.3-stable and 1.4.2-beta, with the beta fix in v1.4.3-beta.

## Output

The full article text of the Tenjin security brief, describing the FileBrowser Quantum subtitle handler vulnerability, the mechanism by which authenticated users could read host text files outside their storage scope, the affected versions (1.3.3-stable and 1.4.2-beta), and the fix introduced in v1.4.3-beta, as published in the July 31 daily advisory.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "required": [
  "input"
 ],
 "properties": {
  "input": {
   "type": "object",
   "required": [
    "type",
    "method"
   ],
   "properties": {
    "type": {
     "type": "string",
     "const": "http"
    },
    "method": {
     "enum": [
      "GET"
     ],
     "type": "string"
    },
    "pathParams": {
     "type": "object",
     "required": [
      "handle",
      "slug"
     ],
     "properties": {
      "slug": {
       "type": "string",
       "description": "The article's URL slug, unique per creator. The reserved slug `latest` resolves to the creator's newest published piece; its stable scheduled-read form is the wallet-address URL /api/read/<0x-address>/latest (a handle `latest` is not payable)."
      },
      "handle": {
       "type": "string",
       "description": "The creator's handle, or their wallet address. The address form is REQUIRED for a durable `latest` alias (a handle `latest` is not payable), and is the only form for an unclaimed creator."
      }
     }
    },
    "queryParams": {
     "type": "object",
     "required": [],
     "properties": {},
     "additionalProperties": false
    }
   },
   "additionalProperties": false
  },
  "output": {
   "type": "object",
   "required": [
    "type"
   ],
   "properties": {
    "type": {
     "type": "string"
    },
    "example": {
     "type": "object"
    }
   }
  }
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/tenjin-security-briefs-filebrowser-subtitle-endpoint-path-traversal-f76a17e4/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from tenjin.blog](https://www.zero.xyz/host/tenjin.blog/llms.txt)