Executive brief
File Browser is a web-based file management utility that allows users to manage files on a server. A security flaw in its command execution feature allows authorized users to bypass security restrictions and run unauthorized commands on the underlying server. This could allow a malicious user with command execution privileges to take full control of the server process, potentially leading to data theft or service disruption.
Technical details
A command injection/bypass vulnerability exists in File Browser's Command Execution feature. While the application attempts to restrict users to a predefined allowlist of shell commands, many standard Linux utilities (such as 'find', 'sed', or 'git') support sub-command execution or flags that spawn shells (GTFOBins). An attacker with 'Execute commands' permissions can leverage these allowed binaries to execute arbitrary code with the privileges of the server process. The vulnerability is addressed in version 2.33.10 by implementing stricter shell command checks, though the maintainers have also disabled the feature by default as a mitigation.
Affected products
- File Browser File Browser 2.x branch prior to 2.33.10
Timeline
- 2025-03-26: disclosed: Vulnerability identified by SBA Research
- 2025-06-25: patched: Patch version pushed to disable feature by default; fix tracked in PR 5199
- 2025-06-26: advisory: GitHub Security Advisory published
References
- https://github.com/GoogleContainerTools/distroless
- https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108
- https://github.com/filebrowser/filebrowser/issues/5199
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-3q2w-42mv-cph4
- https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-02_Filebrowser_Shell_Commands_Can_Spawn_Other_Commands
- https://manpages.debian.org/bookworm/util-linux/prlimit.1.en.html
- https://pkg.go.dev/vuln/GO-2025-3786