Listen to this Post
How the CVE Works
The vulnerability arises from improper allowlist validation in Filebrowser’s command execution feature. The `CanExecute` function in `users/users.go` uses regex-based partial matching instead of exact command validation. For example, if `ls` is permitted, commands like `lsof` or `lsusb` will also be allowed due to substring matching. An attacker with `Execute Commands` permission can exploit this to run unauthorized shell commands, potentially accessing sensitive files or system binaries.
DailyCVE Form
Platform: Filebrowser
Version: 2.32.0
Vulnerability: Command Injection
Severity: Medium
Date: 2025-06-26
Prediction: Patch expected by 2025-07-10
What Undercode Say
Analytics:
grep -r "CanExecute" /path/to/filebrowser/src curl -X POST http://target/filebrowser/exec -d "cmd=lsusb"
Exploit:
1. Gain `Execute Commands` permission.
- Abuse regex partial matching (e.g., `ls` →
lsof).
Protection:
- Update to Filebrowser 2.33.10.
- Restrict command allowlist to exact matches.
Impact:
- Unauthorized shell command execution.
- Potential file/system access.
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
