PT-2025-27006 · Unknown · Filebrowser

Mtausig · Published 2025-06-26 · Updated 2025-08-04 · CVE-2025-52903

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: File Browser version 2.32.0

Description: The issue concerns the Command Execution feature in File Browser, which allows the execution of shell commands predefined on a user-specific allowlist. However, many tools can execute arbitrary commands, rendering this limitation ineffective. The impact depends on the commands granted to the attacker, but most users with Execute commands permissions can exploit this, gaining full code execution rights with the server process's uid.

Recommendations: For version 2.32.0, completely disable Execute commands for all accounts as a temporary workaround. Consider operating File Browser from a distroless container image as a defense-in-depth measure if command execution is not required. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Argument Injection

Command Injection

Weakness Enumeration

CWE-749

CWE-88

CWE-183

CWE-77

Related Identifiers

CVE-2025-52903

GHSA-3Q2W-42MV-CPH4

GO-2025-3786

OPENSUSE-SU-2025:15405-1

Affected Products

Filebrowser

References · 73

• 🔥 https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2w-42mv-cph4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52903.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-52903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52903 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3786 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3q2w-42mv-cph4 · Vendor Advisory
• https://github.com/filebrowser/filebrowser/issues/5199 · Note
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108 · Note
• https://github.com/GoogleContainerTools/distroless · Note
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-02_Filebrowser_Shell_Commands_Can_Spawn_Other_Commands · Note
• https://twitter.com/CVEnew/status/1938308935259136279 · Twitter Post
• https://suse.com/security/cve/CVE-2025-3227 · Note
• https://suse.com/security/cve/CVE-2025-53634 · Note