PT-2026-30904 · Unknown · Filebrowser

Saku0512 · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-35585

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions File Browser versions 2.0.0 through 2.63.1

Description File Browser, a file managing interface, has an issue in its hook system. This system executes administrator-defined shell commands on file events (upload, rename, delete). Variable substitution using os.Expand lacks sanitization, allowing an attacker with file write permission to inject OS commands through malicious filenames containing shell metacharacters. This can lead to Remote Code Execution (RCE). The feature is disabled by default from version 2.33.8 onwards.

Recommendations For versions 2.0.0 through 2.33.7, ensure the hook system is disabled. For versions 2.33.8 through 2.63.1, verify the hook system is disabled. If the hook system is required, avoid using variable substitution or implement robust sanitization of input values like FILE and USERNAME before using os.Expand.

Exploit

Fix

OS Command Injection

Argument Injection

Weakness Enumeration

CWE-78

CWE-88

Related Identifiers

CVE-2026-35585

GHSA-JVPW-637P-H3PW

Affected Products

Filebrowser

References · 7

• 🔥 https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw · Exploit
• https://github.com/filebrowser/filebrowser/issues/5199 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-35585 · Security Note
• https://osv.dev/vulnerability/GHSA-jvpw-637p-h3pw · Vendor Advisory
• https://github.com/filebrowser/filebrowser · Note
• https://twitter.com/infoflowcloud/status/2041570710133301254 · Twitter Post
• https://twitter.com/CVEnew/status/2041569995889823806 · Twitter Post