OS Command Injection in File Browser - Affected Product by File Browser Team

CVE-2026-35585

What is CVE-2026-35585?

The File Browser is susceptible to an OS command injection vulnerability due to inadequate sanitization in its hook system, which is designed for handling file actions like upload, rename, and delete. In versions from 2.0.0 to 2.63.1, an attacker holding file write permissions can exploit this flaw by creating a malicious filename containing shell metacharacters. This allows the attacker to execute arbitrary commands on the server when the hook is triggered, potentially leading to Remote Code Execution (RCE). It is important to note that this feature is disabled by default in versions 2.33.8 and later.

References