CVE-2026-35585: File Browser Command Injection Vulnerability Leading to Remote Code Execution
Summary
CVE-2026-35585: File Browser has a Command Injection via Hook Runner. Affects github.com/filebrowser/filebrowser/v2 versions >= 2.0.0-rc.1, <= 2.63.1. No fix is published. How to fix ↓
Also tracked for
The same CVE-2026-35585 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
File Browser is an open-source file management tool that allows users to manage files through a web interface. It provides features such as file uploads, renaming, and deletion, along with the ability to execute custom shell commands on file events. However, a critical vulnerability exists in its hook system, which can lead to command injection and potential remote code execution.
Vulnerability Detail
The vulnerability arises from the hook system in File Browser, which executes administrator-defined shell commands upon file events. The system uses 'os.Expand' for variable substitution without proper sanitization, allowing an attacker with file write permissions to craft malicious filenames containing shell metacharacters. This can lead to arbitrary OS command execution when the hook is triggered, resulting in remote code execution (RCE). The vulnerability affects all hook events, including before and after file uploads, renames, and deletions.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using shell-based hooks that include variable substitutions like '$FILE' until the package is updated. If hooks are necessary, ensure that they do not accept user-controlled input or sanitize inputs rigorously.
Conclusion
CVE-2026-35585 is a significant vulnerability in File Browser that can lead to remote code execution through command injection. It is crucial for users to update to the latest version or implement workarounds to mitigate the risk. Regular monitoring with tools like Vulert can help maintain security against such vulnerabilities.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
CVE-2026-35585 is a vulnerability in File Browser that allows for command injection via its hook system, potentially leading to remote code execution.
Any authenticated user with file create, upload, or rename permissions in File Browser can exploit this vulnerability if shell-based hooks are configured.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
If immediate updating is not possible, disable any shell-based hooks that utilize user-controlled inputs and ensure that your system is monitored for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
