EUVD-2026-19775
GHSA-jvpw-637p-h3pw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
4DescriptionGitHub Advisory
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 through 2.63.1, the hook system in File Browser - which executes administrator-defined shell commands on file events such as upload, rename, and delete - is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations.
AnalysisAI
Remote code execution in File Browser versions 2.0.0 through 2.63.1 allows authenticated administrators to execute arbitrary OS commands via malicious filenames. The vulnerability stems from unsanitized variable substitution in the hook system, which processes file events (upload, rename, delete) using administrator-defined shell commands. Attackers with file write permissions can inject shell metacharacters into filenames that trigger command execution when hooks fire. No public exploit identified at time of analysis, though EPSS data not provided. The vulnerable feature has been disabled by default from v2.33.8 onwards as a mitigation measure.
Technical ContextAI
File Browser is a web-based file management application written in Go that provides a hook system for automating administrative tasks. The hook system executes shell commands triggered by file events (upload, rename, delete, copy) and performs variable substitution using Go's os.Expand function to inject contextual values like $FILE, $USERNAME, and $DESTINATION into administrator-defined command templates. The vulnerability (CWE-78: OS Command Injection) occurs because os.Expand performs simple string replacement without sanitizing special shell metacharacters (backticks, semicolons, pipe operators, command substitution syntax). When a user with file write permission creates a file with a malicious name like 'innocent.txtwhoami.jpg' or 'file;rm -rf /', these metacharacters are directly interpolated into the hook command string and executed by the underlying shell. The affected product identified by CPE cpe:2.3:a:filebrowser:filebrowser applies to all File Browser installations from version 2.0.0 through 2.63.1. The CVSS vector indicates network-based attack (AV:N) with low complexity (AC:L) but requires high privileges (PR:H), meaning the attacker must already have administrative or privileged file write access to the File Browser instance.
RemediationAI
Organizations should immediately upgrade File Browser to version 2.33.8 or later where the vulnerable hooks feature is disabled by default, though the exact fully-patched version eliminating the underlying code vulnerability is not independently confirmed from available data. After upgrading to v2.33.8+, administrators must manually review hook configurations and either disable hooks entirely or implement strict filename validation at the application layer before files reach the hook system. If upgrading is not immediately feasible, implement these compensatory controls: disable all hooks in the File Browser configuration file, restrict file write permissions to only highly trusted users, implement filesystem-level filename character whitelisting to block shell metacharacters (backticks, semicolons, pipes, dollar signs), and monitor system logs for suspicious command execution patterns. For administrators who require hooks functionality, consider sandboxing the File Browser process using containerization with restricted capabilities, AppArmor, or SELinux policies that prevent shell command execution. Review the official vendor advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw for additional mitigation guidance and subscribe to the project's security notifications for future updates.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-78 – OS Command Injection
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today