PT-2026-49063 · Unknown · Filebrowser
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
File Browser versions prior to 2.33.8
Description
When a shell interpreter is configured, the command allowlist can be bypassed using shell metacharacters. The system validates only the first token of user input, while the entire raw string is passed to the shell. This allows the use of semicolons, pipes, backticks, and
$() to chain and execute arbitrary commands after a permitted one.Recommendations
Update to version 2.33.8.
Exploit
Fix
Incomplete List of Disallowed Inputs
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Filebrowser