Which versions of Filebrowser are affected by CVE-2026-35585?

File Browser versions 2.0.0 through 2.63.1 contain a remote code execution vulnerability that allows authenticated administrators to execute arbitrary operating system commands through malicious…. A patch is available.

How to fix or mitigate CVE-2026-35585?

Within 24 hours: Inventory all File Browser deployments and document current versions in use; disable the hook system feature if enabled in administrative settings. Within 7 days: Restrict file write permissions to trusted users only and audit recent file uploads for suspicious filenames containing shell metacharacters (e.g., $(), backticks, |, &, ;); upgrade to File Browser v2.33.8 or later if possible to benefit from the default-disabled mitigation. Within 30 days: Monitor vendor security advisories for an official patch release and implement network segmentation to limit File Browser administrative access to trusted internal networks only.

Filebrowser CVE-2026-35585

Q: What is the CVSS score of CVE-2026-35585?

CVE-2026-35585 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.8%.

EUVD-2026-19775 HIGH

OS Command Injection (CWE-78)

2026-04-07 GitHub_M

GHSA-jvpw-637p-h3pw

RCE Command Injection Filebrowser

7.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 18:52 vuln.today

cvss_changed

EUVD ID Assigned

Apr 07, 2026 - 17:00 euvd

EUVD-2026-19775

Analysis Generated

Apr 07, 2026 - 17:00 vuln.today

CVE Published

Apr 07, 2026 - 16:20 nvd

HIGH 7.5

DescriptionGitHub Advisory

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 through 2.63.1, the hook system in File Browser - which executes administrator-defined shell commands on file events such as upload, rename, and delete - is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations.

AnalysisAI

Remote code execution in File Browser versions 2.0.0 through 2.63.1 allows authenticated administrators to execute arbitrary OS commands via malicious filenames. The vulnerability stems from unsanitized variable substitution in the hook system, which processes file events (upload, rename, delete) using administrator-defined shell commands. Attackers with file write permissions can inject shell metacharacters into filenames that trigger command execution when hooks fire. No public exploit identified at time of analysis, though EPSS data not provided. The vulnerable feature has been disabled by default from v2.33.8 onwards as a mitigation measure.

Technical ContextAI

File Browser is a web-based file management application written in Go that provides a hook system for automating administrative tasks. The hook system executes shell commands triggered by file events (upload, rename, delete, copy) and performs variable substitution using Go's os.Expand function to inject contextual values like $FILE, $USERNAME, and $DESTINATION into administrator-defined command templates. The vulnerability (CWE-78: OS Command Injection) occurs because os.Expand performs simple string replacement without sanitizing special shell metacharacters (backticks, semicolons, pipe operators, command substitution syntax). When a user with file write permission creates a file with a malicious name like 'innocent.txtwhoami.jpg' or 'file;rm -rf /', these metacharacters are directly interpolated into the hook command string and executed by the underlying shell. The affected product identified by CPE cpe:2.3:a:filebrowser:filebrowser applies to all File Browser installations from version 2.0.0 through 2.63.1. The CVSS vector indicates network-based attack (AV:N) with low complexity (AC:L) but requires high privileges (PR:H), meaning the attacker must already have administrative or privileged file write access to the File Browser instance.

RemediationAI

Organizations should immediately upgrade File Browser to version 2.33.8 or later where the vulnerable hooks feature is disabled by default, though the exact fully-patched version eliminating the underlying code vulnerability is not independently confirmed from available data. After upgrading to v2.33.8+, administrators must manually review hook configurations and either disable hooks entirely or implement strict filename validation at the application layer before files reach the hook system. If upgrading is not immediately feasible, implement these compensatory controls: disable all hooks in the File Browser configuration file, restrict file write permissions to only highly trusted users, implement filesystem-level filename character whitelisting to block shell metacharacters (backticks, semicolons, pipes, dollar signs), and monitor system logs for suspicious command execution patterns. For administrators who require hooks functionality, consider sandboxing the File Browser process using containerization with restricted capabilities, AppArmor, or SELinux policies that prevent shell command execution. Review the official vendor advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw for additional mitigation guidance and subscribe to the project's security notifications for future updates.