CVE-2025-52904 json
File Browser: Command Execution not Limited to Scope
published 2025-06-26 16 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-19557 , GHSA-hc8f-m8g5-8362 , GO-2025-3793
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.1%
- EPSS 1.1% chance of exploitation in 30 days, percentile 66%
- public exploits
- 0
- none known
Summary
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities.
Patch / fix
- go github.com/filebrowser/filebrowser/v2 2.33.8
- filebrowser filebrowser 2.33.8
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250730T213748-1.1
opensuse advisories openSUSE-SU-2025:15405-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 16 mo ago
Exploit prediction
1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hc8f-m8g5-8362 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/filebrowser/filebrowser/v2 | <2.33.8 all versions |
2.33.8 |
| go | github.com/filebrowser/filebrowser | all versions |
no fix listed |
Affected products
- filebrowser filebrowser
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/filebrowser/filebrowser/security/advisories/GHSA-hc8f-m8g5-8362
exploit, web, mitigation, vendor-advisory, advisory
-
github.com
/filebrowser/filebrowser/issues/5199
web, issue-tracking, report
-
github.com
/GoogleContainerTools/distroless
web, product
-
github.com
/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-01_Filebrowser_Command_Execution_Not_Limited_To_Scop
web
-
pkg.go.dev
/vuln/GO-2025-3793
web
-
sloonz.github.io
/posts/sandboxing-1
web, technical-description
-
nvd.nist.gov
/vuln/detail/CVE-2025-52904
advisory
-
github.com
/filebrowser/filebrowser
package
Sources
- CVE List CVE-2025-52904
- GitHub Advisory GHSA-hc8f-m8g5-8362
- NVD CVE-2025-52904
- OSV GO-2025-3793
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.