CVE-2025-52904

Deeper analysis

File Browser is a web application that provides a file management interface for a specified directory, supporting operations such as upload, delete, preview, rename, and edit. In the 2.x branch, every user is assigned a scope that should limit access to files within that directory. The Command Execution feature, however, permits execution of arbitrary shell commands without enforcing the assigned scope, allowing bypass of these restrictions and resulting in read and write access to all files managed by the server. The issue is tracked as CWE-77 and carries a CVSS 3.1 score of 8.0.

An attacker can exploit the flaw only after an instance administrator explicitly enables the Command Execution feature despite built-in warnings. Once enabled, any authenticated user can run unrestricted shell commands, achieving full access to the server's file system regardless of their configured scope. The vulnerability therefore requires administrative misconfiguration rather than remote unauthenticated access.

Advisories and the project repository state that the Execute commands feature should be disabled for all accounts until a fix is applied. The maintainers have disabled the feature by default in version 2.33.8 for both new and existing installations, and they recommend complete deactivation in earlier 2.x releases. The referenced security advisory and Go vulnerability database entry document this configuration change as the primary mitigation.

EPSS for the CVE rose from a low baseline to a recorded peak of 0.0115, indicating emerging exploitation interest after disclosure. No confirmed real-world exploitation campaigns are noted in the provided references.