PT-2025-27473 · Unknown · Filebrowser

Mtausig · Published 2025-03-25 · Updated 2025-08-04 · CVE-2025-52995

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: File Browser versions prior to 2.33.10

Description: The issue affects the implementation of the allowlist in File Browser, allowing unauthorized execution of shell commands. The impact depends on the configured commands and installed binaries on the server or container image. Due to the lack of separation of scopes on the OS-level, an attacker could access all files managed by the application, including the File Browser database.

Recommendations: For versions prior to 2.33.10, update to version 2.33.10 to resolve the issue.

Exploit

Fix

LPE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2025-08007

CVE-2025-52995

GHSA-W7QC-6GRJ-W7R8

GO-2025-3795

OPENSUSE-SU-2025:15405-1

Affected Products

Filebrowser

References · 75

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52995.json · Exploit
• https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108 · Patch
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w7qc-6grj-w7r8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52995 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52995 · Security Note
• https://osv.dev/vulnerability/GO-2025-3795 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-08007 · Security Note
• https://osv.dev/vulnerability/GHSA-w7qc-6grj-w7r8 · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://github.com/filebrowser/filebrowser/releases/tag/v2.33.10 · Note
• https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-05_Filebrowser_Bypass_Command_Execution_Allowlist · Note
• https://t.me/cvetracker/27459 · Telegram Post
• https://suse.com/security/cve/CVE-2025-3227 · Note
• https://suse.com/security/cve/CVE-2025-53634 · Note