`/api/resources/download` returns status 500 when file is not found

Author: avioletheartCreated Sep 19, 2026Updated Sep 19, 2026
Labelsbug

Description basically the title. requesting /api/resources/download?source=xxx&file=yyy.ext returns a 500 status code instead of 404 when the file is not found (including if the parent directory does exist).

Expected behaviour returns 404 status code and does not leak file path on disk

What is happening instead?

mizuki:~# curl 'https://files.mydomain.com/api/resources/download?source=data&file=inexistent'
{"status":500,"message":"could not resolve symlinks for /mnt/slow/data/inexistent: lstat /mnt/slow/data/inexistent: no such file or directory"}

server log:

Sep 19 22:26:46 nas filebrowser[1717005]: 2026/09/19 22:26:46 GET     | 500 | 127.0.0.1       | aviolethea.. | 0ms          | "/api/resources/download?source=data&file=inexistent"

Additional context filebrowser quantum v1.5.6-stable

How to reproduce? provide an inexistent filename to /api/resources/download on a source you have permissions to access

Source: gtsteffaniak/filebrowser