CVE-2025-52903: Filebrowser Command Execution RCE Flaw

CVE-2025-52903 Overview

CVE-2025-52903 is a command injection vulnerability [CWE-77] in File Browser, a web application that provides a file management interface within a specified directory. Versions on the 2.x branch prior to 2.33.10 restrict the Command Execution feature to a user-specific allowlist of shell commands. However, many standard commands on the allowlist can spawn arbitrary subcommands, rendering the restriction ineffective. Any authenticated user granted Execute commands permission can leverage this weakness to obtain full code execution under the uid of the File Browser server process.

Critical Impact
Authenticated users with command execution privileges can bypass the shell command allowlist and execute arbitrary code with the privileges of the File Browser server process.

Affected Products

File Browser (filebrowser/filebrowser) 2.x branch prior to 2.33.10
Deployments exposing the Command Execution feature to non-administrative users
Container and self-hosted installations of File Browser using the vulnerable 2.x releases

Discovery Timeline

2025-06-26 - CVE-2025-52903 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52903

Vulnerability Analysis

File Browser exposes a Command Execution feature that lets administrators grant specific users the ability to run shell commands from within the web interface. Each user has a per-account allowlist of permitted command names. The intent is to constrain what a delegated user can invoke through the built-in terminal.

The allowlist check only inspects the top-level command string. It does not evaluate any subcommands, arguments, or child processes that the initial binary may execute. Because a large number of standard Unix utilities can spawn arbitrary binaries as part of their normal functionality, an attacker with the Execute commands permission can pivot from a whitelisted command to arbitrary program execution. All resulting processes run with the uid of the File Browser server, which is typically a service account with access to the entire managed directory tree.

Root Cause

The root cause is incomplete input validation in the command execution handler. File Browser matched requested commands against a static allowlist of program names but did not sanitize or restrict command arguments. Utilities that accept a script, subcommand, or -exec style flag effectively serve as trampolines to arbitrary code execution. The fix in version 2.33.10 introduces a check for whether a command is allowed when it is invoked through a shell.

Attack Vector

Exploitation requires network access to the File Browser interface and an authenticated account holding the Execute commands permission. The attacker submits a request to the command execution endpoint using a command present on their allowlist. The command argument list contains directives that cause the allowed binary to launch another program, spawn a shell, or evaluate arbitrary input. The vulnerability details are documented in the SBA Research Advisory SBA-ADV-20250326-02 and the GitHub Security Advisory GHSA-3q2w-42mv-cph4.

Detection Methods for CVE-2025-52903

Indicators of Compromise

Unexpected child processes spawned by the File Browser service account, particularly shells such as /bin/sh, /bin/bash, python, or perl.
Command execution audit entries in File Browser logs where allowlisted commands include flags like -c, -exec, or subcommand invocations.
Outbound network connections initiated by the File Browser process to unfamiliar destinations.
New or modified files under the File Browser managed directory that do not correspond to user upload activity.

Detection Strategies

Monitor process ancestry for the filebrowser binary and flag any descendant that is not on an approved list.
Review File Browser command execution audit logs for arguments containing shell metacharacters, script paths, or subcommand keywords.
Alert on accounts with Execute commands permission running commands outside their normal operational baseline.

Monitoring Recommendations

Forward File Browser access and command logs to a centralized logging or SIEM platform for correlation with host telemetry.
Enable Linux auditd rules for execve calls made by the File Browser service user.
Track version strings returned by File Browser instances to identify installations still running releases prior to 2.33.10.

How to Mitigate CVE-2025-52903

Immediate Actions Required

Upgrade File Browser to version 2.33.10 or later, which enforces allowlist validation for shell-executed commands.
Inventory all File Browser deployments and confirm the running version against the fixed release.
Audit user accounts and remove the Execute commands permission from any user that does not strictly require it.
Rotate credentials and review file integrity in any environment where the vulnerability may have been exploited.

Patch Information

The fix is delivered in File Browser 2.33.10. Upstream commit 4d830f707fc4314741fd431e70c2ce50cd5a3108 adds validation to ensure that commands executed through the shell are checked against the per-user allowlist. Additional context is available in GitHub Filebrowser Issue 5199 and the Go Vulnerability Report GO-2025-3786.

Workarounds

Disable the Command Execution feature entirely for all users until the upgrade is applied.
Run File Browser as an unprivileged user inside a minimal container image such as the GoogleContainerTools Distroless project to reduce the utilities available to an attacker.
Restrict outbound network access from the File Browser host using firewall rules to limit post-exploitation options.
Apply resource limits to the File Browser process using tools such as prlimit to constrain the impact of unauthorized command execution.

bash

# Configuration example: remove Execute commands permission from a user
filebrowser users update <username> --perm.execute=false

# Verify installed version meets the fixed release
filebrowser version