CVE-2026-34528: File Browser RCE Vulnerability

CVE-2026-34528 Overview

CVE-2026-34528 is a privilege escalation vulnerability in File Browser, a web-based file management interface used for uploading, deleting, previewing, renaming, and editing files within a specified directory. The vulnerability exists in the signupHandler function, which improperly applies default user permissions during the self-registration process. When signup is enabled alongside server-side execution with Execute=true in the default user template, newly registered users can inherit shell execution capabilities and execute arbitrary commands on the server.

Critical Impact

Unauthenticated attackers can self-register and inherit shell execution permissions, enabling arbitrary command execution on the server without administrative approval.

Affected Products

• File Browser versions prior to 2.62.2

Discovery Timeline

• 2026-04-01 - CVE CVE-2026-34528 published to NVD
• 2026-04-02 - Last updated in NVD database

Technical Details for CVE-2026-34528

Vulnerability Analysis

This vulnerability falls under the category of Improper Privilege Management (CWE-269). The root cause lies in how File Browser's signup handler processes default user permissions during user registration. While the code correctly strips the Admin permission from newly registered users, it fails to remove the Execute permission and associated Commands list inherited from the default user template.

The flaw requires a specific configuration where an administrator has enabled user self-registration, server-side command execution, and set Execute=true in the default user template. While this combination of settings may not be common in production environments, when present, it creates a direct path from unauthenticated access to remote code execution.

The vulnerability is exploitable over the network without authentication, though it requires the specific misconfiguration to be in place. Successful exploitation grants attackers the ability to run arbitrary shell commands with the privileges of the File Browser process, potentially leading to complete system compromise.

Root Cause

The vulnerability stems from incomplete permission sanitization in the signupHandler function. When the function calls d.settings.Defaults.Apply(user) to apply default settings to a new user account, it subsequently strips only the Admin privilege. The Execute permission and the Commands list are not removed from the user object, allowing these dangerous capabilities to persist for self-registered users.

Attack Vector

The attack exploits the network-accessible signup functionality. An attacker can:

1. Access the File Browser instance with public signup enabled
2. Create a new user account through the self-registration process
3. Inherit the Execute permission and Commands list from the default user template
4. Use the inherited shell execution capabilities to run arbitrary commands on the underlying server

The vulnerability mechanism involves improper permission stripping during user registration. The signupHandler function applies default user permissions but only removes the Admin flag while preserving dangerous execution capabilities. For technical implementation details, see the GitHub Security Advisory GHSA-x8jc-jvqm-pm3f.

Detection Methods for CVE-2026-34528

Indicators of Compromise

• Unexpected user accounts created through the signup functionality
• Command execution logs showing activity from recently registered users
• Unusual process spawning from the File Browser service account
• Web server logs showing signup requests followed by command execution API calls

Detection Strategies

• Monitor File Browser logs for new user registrations and correlate with subsequent command execution activity
• Implement alerting on process creation events from the File Browser service context
• Review user accounts for unexpected execution permissions granted during registration
• Deploy endpoint detection rules for anomalous shell command patterns originating from web application processes

Monitoring Recommendations

• Enable verbose logging for the File Browser application to capture user creation and command execution events
• Configure SIEM rules to detect correlation between signup events and command execution within short time windows
• Monitor network traffic for reconnaissance activity following successful user registration
• Implement file integrity monitoring on critical system files to detect post-exploitation modifications

How to Mitigate CVE-2026-34528

Immediate Actions Required

• Upgrade File Browser to version 2.62.2 or later immediately
• Disable user self-registration if not strictly required for business operations
• Review existing user accounts for unexpected execution permissions and revoke as necessary
• Audit the default user template and remove the Execute permission if not required

Patch Information

The vulnerability has been addressed in File Browser version 2.62.2. The patch properly strips both the Admin permission and the Execute permission along with the Commands list from users created through the signup handler. Organizations should upgrade to this version or later to remediate the vulnerability.

For detailed patch information, see the GitHub Release v2.62.2 and the GitHub Security Advisory GHSA-x8jc-jvqm-pm3f.

Workarounds

• Disable the signup functionality by setting the appropriate configuration option until patching is complete
• Remove the Execute permission from the default user template to prevent inheritance
• Implement network-level access controls to restrict signup endpoint access to trusted networks only
• Deploy a web application firewall rule to block or monitor signup requests while mitigation is in progress

# Disable signup in File Browser configuration
# Edit the config file or use command line flags
filebrowser config set --signup=false

# Alternatively, ensure Execute is disabled in default user template
# Review and modify settings via the admin interface or config file