CVE-2025-52904
The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities.
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
- EPSS
- 0.96% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- filebrowser/filebrowser
- Source
- security-advisories@github.com
References
- https://github.com/GoogleContainerTools/distrolessProduct
- https://github.com/filebrowser/filebrowser/issues/5199Issue Tracking
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hc8f-m8g5-8362Exploit, Mitigation, Vendor Advisory
- https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-01_Filebrowser_Command_Execution_Not_Limited_To_Scope
- https://pkg.go.dev/vuln/GO-2025-3793
- https://sloonz.github.io/posts/sandboxing-1Technical Description
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hc8f-m8g5-8362Exploit, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.