LiveActive security incident?Get immediate response
CVE Record

CVE-2025-52903: File Browser Allows Execution of Shell Commands That Can Spawn Other Commands

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions on the 2.x branch prior to 2.33.10, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends on the commands being granted to the attacker, but the large number of standard commands allowing the execution of subcommands makes it likely that every user having the `Execute commands` permissions can exploit this vulnerability. Everyone who can exploit it will have full code execution rights with the uid of the server process. Version 2.33.10 contains a check for whether a command is allowed when using shell.

HighCVSS 8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

File Browser’s command allowlist could be bypassed by users who already had command-execution permission. That can turn a limited approved-command feature into full code execution as the File Browser server user. This is serious for shared or internet-reachable deployments, but it requires privileged application access.

Executive priority

Prioritize remediation where File Browser is shared, remotely accessible, or used by non-administrative users with command-execution rights. Treat affected systems as high risk because successful abuse gives server-user code execution, but scope triage should focus on who has the Execute commands permission.

Technical view

In File Browser 2.x before 2.33.10, the Command Execution feature restricted users to predefined commands, but allowed commands could spawn other commands. This undermined the allowlist and could provide code execution with the server process UID. Version 2.33.10 adds a command-allowed check when using shell.

Likely exposure

Exposure is limited to File Browser versions 2.0.0 through before 2.33.10 where users have the Execute commands permission. Risk increases when those users are untrusted, externally authenticated, or when the server process has broad filesystem or host privileges.

Exploitation context

The CVSS vector indicates network access, high attack complexity, high privileges required, no user interaction, and changed scope. The bundle does not indicate CISA KEV listing or confirmed active exploitation. Impact depends on which commands were granted to the attacker.

Researcher notes

The key exposure condition is not every File Browser user, but users granted Execute commands. The advisory states many standard tools can spawn subcommands, making the allowlist unreliable. Evidence in the bundle supports fixed version 2.33.10, not broader affected product claims.

Mitigation direction

  • Upgrade File Browser 2.x deployments to version 2.33.10 or later.
  • Remove Execute commands permission from users who do not explicitly need it.
  • Review command allowlists and remove commands that can invoke other commands.
  • Run File Browser with the least-privileged server UID possible.
  • Check current vendor guidance before relying on compensating controls.

Validation and detection

  • Inventory File Browser deployments and confirm their exact versions.
  • Identify users or groups with Execute commands permission.
  • Review configured command allowlists for affected users.
  • Confirm upgraded instances report version 2.33.10 or later.
  • Review logs for unexpected command-execution activity where available.
Prepared
Confidence
high
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-77: Command execution behavior lookup

Command injection weaknesses can lead defenders to review execution techniques and command interpreter telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Execution behavior lookup

The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2025-52903 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
1ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: pocAutomatable: noTechnical Impact: total

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
8CVSS 3.1HighCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H1.36GitHub_M

Vulnerability scoring details

Base CVSS 3.1 score

8High
CVSS 3.1 vector shape for CVE-2025-52903Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
filebrowserfilebrowser>= 2.0.0, < 2.33.10Listed
Weakness

CWE details

CWE-77

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-77 · source CWE mapping

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Improper Neutralization of Special Elements used in a Command ('Command Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs