Command Execution Vulnerability in File Browser by File Browser Team

CVE-2025-52903

What is CVE-2025-52903?

A command execution vulnerability exists in File Browser, where users with 'Execute commands' permissions can execute arbitrary commands due to a flawed allowlist mechanism. The impact is significant as it grants attackers full code execution rights with the server process UID. To mitigate this risk, it is advised to disable the 'Execute commands' feature for all users and utilize a distroless container image. While a patch has been implemented to make this feature opt-in and add warnings, the vulnerability remains unfixed in the project's maintenance-only mode. Users should take immediate precautions to secure their deployments.

References