CVE-2025-52903
BaseFortify
Publication date: 2025-06-26
Last updated on: 2025-08-05
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | 2.32.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-52903 is a high-severity vulnerability in File Browser version 2.32.0 affecting its Command Execution feature. Although this feature restricts users to executing only predefined shell commands on a user-specific allowlist, many standard Linux commands allowed by this list can spawn arbitrary subcommands, effectively bypassing the restriction. For example, commands like 'find' can be exploited to run arbitrary commands, enabling full code execution with the server process's user ID for any user with Execute Commands permission. This means an attacker with such permissions can execute any code on the server, leading to a complete compromise. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability allows an attacker with Execute Commands permission to gain full code execution rights on the server running File Browser, using the server process's user ID. This can lead to unauthorized access, data manipulation, service disruption, and potentially full system compromise. The impact includes loss of confidentiality, integrity, and availability of the system and its data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for execution of commands like `find`, `cpio`, `sed`, `git`, and `env` that are allowed by the File Browser's command allowlist but can be exploited to run arbitrary subcommands. A proof of concept involves using `find` with the `-exec` flag to perform unauthorized actions such as network calls. While no specific detection commands are provided, monitoring for unusual usage of these commands or unexpected network calls initiated by the File Browser process could indicate exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include completely disabling the Execute Commands feature for all accounts until a fix is available, as this feature is inherently dangerous and not required by all deployments. Additionally, applying process creation limits using the `prlimit` command with the `--nproc=0` option can prevent subcommand execution by causing commands like `find` to fail when attempting to fork new processes. Running File Browser from a distroless container image is recommended as a defense-in-depth measure. The patch released disables the Execute Commands feature by default and makes it opt-in, with warnings added to documentation and console output when enabled. [1, 2, 3]