News

SBA Security Advisory – Filebrowser Command Execution not Limited to Scope (CVE-2025-52904)

Vulnerability Overview

In the web application, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server.

• Type of Vulnerability: Command Execution not Limited to Scope
• Fixed in Version: Not yet
• CVE ID: CVE-2025-52904
• CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
• CVSS Base Score: 8.0 (High)

Recommended Countermeasure

We recommend to disable the command execution feature according to the documentation (default since 2.33.8). Further fixes are tracked in the GitHub issue #5199.

Links

Full Security Advisory

Credits

Mathias Tausig (SBA Research)