CVE-2021-46398: A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a...

Security readout for executives and security teams

Filebrowser before 2.18.0 is reported vulnerable to CSRF that can let an attacker abuse a logged-in administrator’s browser to create a new administrator account. That account could then access the filesystem, and Filebrowser command execution capability makes the reported impact remote code execution. Organizations are exposed if they run Filebrowser earlier than 2.18.0, especially where administrators access it from browsers that also visit untrusted pages. Internet-facing deployments raise business risk, but the CVE record does not provide CPEs or environment details. Treat this as a prompt upgrade and exposure-reduction item for any Filebrowser deployment. The business concern is unauthorized administrative access to stored files and potential command execution, but evidence of active exploitation is not established in the provided sources. Mitigation focus: Upgrade Filebrowser to 2.18.0 or later, following vendor guidance.; Restrict Filebrowser administrative access to trusted networks or VPN.; Review and remove unexpected Filebrowser administrator accounts..

Prepared

Jun 2, 2026, 11:02 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.