What is the CVSS score of CVE-2025-52904?

CVE-2025-52904 has a contested CVSS base score of 8.0 from a third party (e.g. CISA-ADP), while the vendor rates it High. vuln.today uses the vendor rating as authoritative.

Which versions of Filebrowser are affected by CVE-2025-52904?

CVE-2025-52904 presents notable security risk, a command injection vulnerability rated CVSS 8.0.. A patch is available.

Is there a public PoC exploit available for CVE-2025-52904?

Yes, a public proof-of-concept exploit is available for CVE-2025-52904. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2025-52904?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Filebrowser CVE-2025-52904

EUVD-2025-19557 HIGH

Command Injection (CWE-77)

2025-06-26 security-advisories@github.com

GHSA-hc8f-m8g5-8362

Command Injection Filebrowser

High

Disputed · 8.0 NVD

Severity by source

Sources disagree (Low–High)

GitHub Advisory PRIMARY

8.0 HIGH

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

SUSE

3.1 LOW

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Apr 06, 2026 - 14:30 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 23:54 euvd

EUVD-2025-19557

Analysis Generated

Mar 15, 2026 - 23:54 vuln.today

PoC Detected

Aug 05, 2025 - 18:25 vuln.today

Public exploit code

CVE Published

Jun 26, 2025 - 19:15 nvd

HIGH 8.0

DescriptionGitHub Advisory

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable Execute commands for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199.

Analysis

Technical ContextAI

Command injection allows an attacker to execute arbitrary OS commands on the host system through a vulnerable application that passes user input to system shells.

RemediationAI

Avoid passing user input to system commands. Use language-specific APIs instead of shell commands. If unavoidable, use strict input validation and escaping.