filebrowser 2.32.0 command injection

Summaryinfo

A vulnerability identified as critical has been detected in filebrowser 2.32.0. Affected by this issue is some unknown functionality. This manipulation causes command injection. The identification of this vulnerability is CVE-2025-52904. It is possible to initiate the attack remotely. There is no exploit available. Applying a patch is the recommended action to fix this issue.

Detailsinfo

A vulnerability classified as problematic was found in filebrowser 2.32.0. Affected by this vulnerability is some unknown functionality. The manipulation with an unknown input leads to a command injection vulnerability. The CWE definition for the vulnerability is CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0 of the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on pull request 5199.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-52904 since 06/20/2025. The exploitation appears to be difficult. The attack can be launched remotely. Additional levels of successful authentication are needed for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19557). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• filebrowser

Version

• 2.32.0

Website

• Product: https://github.com/filebrowser/filebrowser/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion