Is CVE-2025-52903 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-52903 being exploited in the wild.

How severe is CVE-2025-52903?

High severity, with a CVSS score of 8, published 26 June 2025.

Which products and versions are affected?

File Browser < 2.33.10, 2.x branch prior to 2.33.10; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) < 2.33.10, SEMVER:introduced=0,fixed=2.33.10.

Is there a fix for CVE-2025-52903?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-52903 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2025-52903?

Check whether you run File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52903: File Browser arbitrary command execution via allowlist bypass

Q: Which products and versions are affected?

File Browser < 2.33.10, 2.x branch prior to 2.33.10; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) < 2.33.10, SEMVER:introduced=0,fixed=2.33.10.

Q: Is there a fix for CVE-2025-52903?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2025-52903 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2025-52903?

Check whether you run File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-52903 · Severity: high · CVSS 8 · Published 2025-06-26

File Browser is a web-based file management utility that allows users to manage files on a server. A security flaw in its command execution feature allows authorized users to bypass security restrictions and run unauthorized commands on the underlying server. This could allow a malicious user with command execution privileges to take full control of the server process, potentially leading to data theft or service disruption.

Technologies: File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, FileBrowser, Go.

Quick answers

Is CVE-2025-52903 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-52903 being exploited in the wild.
How severe is CVE-2025-52903?: High severity, with a CVSS score of 8, published 26 June 2025.
Which products and versions are affected?: File Browser < 2.33.10, 2.x branch prior to 2.33.10; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) < 2.33.10, SEMVER:introduced=0,fixed=2.33.10.
Is there a fix for CVE-2025-52903?: Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-52903 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-52903?: Check whether you run File Browser, Filebrowser, github.com/filebrowser/filebrowser (Go) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.33.10 or later
```
go get github.com/filebrowser/filebrowser/v2@v2.33.10
```

Technical details

A command injection/bypass vulnerability exists in File Browser's Command Execution feature. While the application attempts to restrict users to a predefined allowlist of shell commands, many standard Linux utilities (such as 'find', 'sed', or 'git') support sub-command execution or flags that spawn shells (GTFOBins). An attacker with 'Execute commands' permissions can leverage these allowed binaries to execute arbitrary code with the privileges of the server process. The vulnerability is addressed in version 2.33.10 by implementing stricter shell command checks, though the maintainers have also disabled the feature by default as a mitigation.

Affected products

File Browser File Browser 2.x branch prior to 2.33.10

Identifiers

CVE-2025-52903
GHSA-3q2w-42mv-cph4
GO-2025-3786

Timeline

2025-03-26: disclosed: Vulnerability identified by SBA Research
2025-06-25: patched: Patch version pushed to disable feature by default; fix tracked in PR 5199
2025-06-26: advisory: GitHub Security Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.