CVE-2025-52995
BaseFortify
Publication date: 2025-06-30
Last updated on: 2025-07-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | to 2.33.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-52995 is a vulnerability in File Browser versions up to 2.33.8 where the allowlist for shell command execution is implemented incorrectly. Instead of enforcing exact matches for allowed commands, the system permits partial matches, allowing users with execute permissions to run unauthorized commands that contain allowed commands as substrings. For example, if a user is allowed to run 'ls', they could also run 'lsof' or 'lsusb'. This flaw arises from improper validation in the CanExecute function, enabling attackers to execute more shell commands than intended. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with an account that has 'Execute commands' permission to run unauthorized shell commands on the server or container where File Browser is running. The impact depends on the configured allowed commands and installed binaries, but it can lead to unauthorized access to all files managed by the application, including sensitive data like the File Browser database. Because there is no OS-level scope separation, this could result in a high level of confidentiality, integrity, and availability compromise. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by verifying if users with 'Execute commands' permission can run shell commands beyond their configured allowlist due to partial matching. To detect exploitation attempts, monitor command execution logs for unauthorized commands that contain allowed commands as substrings (e.g., if 'ls' is allowed, check if commands like 'lsof' or 'lsusb' are executed). You can also test by attempting to execute commands that should be disallowed but contain allowed commands as substrings. Specific commands depend on your environment, but examples include running 'lsof' or 'lsusb' if 'ls' is allowed. Additionally, review the File Browser version; versions prior to 2.33.10 are vulnerable. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade File Browser to version 2.33.10 or later, where the vulnerability is fixed by enforcing exact command matching in the allowlist. If upgrading is not immediately possible, restrict or disable the 'Execute commands' permission for users, and carefully review and limit the allowed commands to minimize risk. Also, consider disabling command execution globally if not needed. Monitoring and logging command executions can help detect exploitation attempts until the patch is applied. [1, 2]