CVE-2026-35585
OS Command Injection in File Browser Hook System Enables RCE
Publication date: 2026-04-07
Last updated on: 2026-04-16
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | From 2.0.0 (inc) to 2.63.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35585 is a high-severity command injection vulnerability in the File Browser project affecting versions 2.0.0 through 2.63.1. The vulnerability exists in the hook system, which allows administrators to define shell commands triggered by file events such as upload, rename, and delete.
The core issue is that variable substitution for values like $FILE and $USERNAME is performed using Go's os.Expand function without any sanitization or escaping of shell metacharacters. This means an attacker with file write permissions can craft a malicious filename containing shell metacharacters that, when the hook executes, causes the server to run arbitrary OS commands.
This results in Remote Code Execution (RCE) on the server with the privileges of the File Browser process. The vulnerable feature has been disabled by default starting from version 2.33.8, but remains exploitable if explicitly enabled.
How can this vulnerability impact me? :
This vulnerability allows any authenticated user with file write permissions to execute arbitrary operating system commands on the server running File Browser.
Because the hook system executes administrator-defined shell commands on file events without sanitizing input, an attacker can inject malicious commands via crafted filenames.
The impact includes full Remote Code Execution (RCE), which can compromise the confidentiality, integrity, and availability of the server and its data.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the File Browser installation is running a vulnerable version (from 2.0.0 through 2.63.1) and if the hook system is enabled and configured to execute shell commands on file events.
To detect exploitation attempts or presence of malicious filenames, you can monitor file upload, rename, or delete events for suspicious filenames containing shell metacharacters such as ;, &, |, or backticks.
Suggested commands to detect suspicious files or activity include:
- Find files with suspicious characters in filenames (example for Linux): find /path/to/filebrowser/root -name '*[;&|`]*'
- Check running processes or logs for unexpected shell commands triggered by hooks.
- Review File Browser configuration to see if hooks are enabled and what commands are defined.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling the hook system feature if it is enabled, as this feature has been disabled by default starting from version 2.33.8.
If you must use hooks, avoid enabling them or ensure that no untrusted users have file write permissions, since any authenticated user with file write permissions can exploit this vulnerability.
Additionally, monitor and restrict file uploads or renames to prevent filenames containing shell metacharacters.
Currently, no patched versions are available, so disabling the vulnerable feature or upgrading to a version where the hook system is disabled by default is the best immediate action.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated users with file write permissions to execute arbitrary OS commands remotely, resulting in Remote Code Execution (RCE) on the server.
Such a vulnerability can lead to unauthorized access, modification, or deletion of sensitive data, which may compromise confidentiality, integrity, and availability of information.
This impact can affect compliance with common standards and regulations like GDPR and HIPAA, which require protection of sensitive data and secure system operations.
However, the provided context and resources do not explicitly discuss compliance implications or specific regulatory impacts.