CVE-2025-52995: File Browser Command Execution Allowlist Bypass Vulnerability
Summary
CVE-2025-52995: File Browser vulnerable to command execution allowlist bypass. Affects github.com/filebrowser/filebrowser/v2 versions < 2.33.10. Fixed in 2.33.10. How to fix ↓
Also tracked for
The same CVE-2025-52995 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
File Browser is an open-source file management application that allows users to manage files and directories through a web interface. It provides features such as file uploads, downloads, and command execution. However, a flaw in its command execution feature has been identified, which allows users to execute unauthorized shell commands due to an improper allowlist implementation.
Vulnerability Detail
The vulnerability arises from the command execution feature in File Browser, which is supposed to restrict users to a predefined list of commands. However, the implementation uses a regular expression that allows partial matches. This means that if a user is granted permission to execute a command like 'ls', they can also execute commands like 'lsof' and 'lsusb', which may lead to unauthorized access to sensitive files and data managed by the application. The impact of this vulnerability is significant, as it could allow an attacker to access the File Browser database and other critical files on the server.
How To Fix
Latest published version: v2.63.23 as of 22 Oct 2026
go get github.com/filebrowser/filebrowser/v2@v2.63.23Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.33.10
This is the first release that contains the fix.
go get github.com/filebrowser/filebrowser/v2@v2.33.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can restrict user permissions and limit the commands available in the allowlist until the package is updated. Ensure that only the necessary commands are included in the 'Commands' field for each user.
Conclusion
The File Browser command execution allowlist bypass vulnerability (CVE-2025-52995) poses a significant risk to users by allowing unauthorized command execution. It is crucial to update to the patched version and implement necessary security measures to protect sensitive data.
See every vulnerability recorded for github.com/filebrowser/filebrowser/v2 →
FAQ
The vulnerability allows users to execute unauthorized shell commands due to an improper allowlist implementation in the command execution feature.
An attacker could gain access to sensitive files and data managed by the application, including the File Browser database.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Update the File Browser package to version 2.33.10 or later and restrict user permissions as a temporary measure.
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/filebrowser/filebrowser/v2.
