CVE-2021-37794

A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.

• CWE-79

• https://gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5cThird Party Advisory
• https://github.com/filebrowser/filebrowserProduct, Third Party Advisory
• https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbdPatch, Third Party Advisory
• https://gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5cThird Party Advisory
• https://github.com/filebrowser/filebrowserProduct, Third Party Advisory
• https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbdPatch, Third Party Advisory

Published

Aug 31, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-37786Certain Federal Office of Information Technology Systems and…4.6
• CVE-2021-37787The unprivileged administrative interface in ABO.CMS version…6.5
• CVE-2021-37788A vulnerability in the web UI of Gurock TestRail v5.3.0.3603…5.4
• CVE-2021-37789stb_image.h 2.27 has a heap-based buffer over in stbi__jpeg_…8.1
• CVE-2021-3779A malicious MySQL server can request local file content from…6.5
• CVE-2021-37791MyAdmin v1.0 is affected by an incorrect access control vuln…4.9
• CVE-2021-3780peertube is vulnerable to Improper Neutralization of Input D…6.1
• CVE-2021-37803An SQL Injection vulnerability exists in Sourcecodester Onli…8.1
• CVE-2021-37805A Stored Cross Site Scripting (XSS) vunerability exists in S…5.4
• CVE-2021-37806An SQL Injection vulnerability exists in https://phpgurukul.…5.9
• CVE-2021-37807An SQL Injection vulneraility exists in https://phpgurukul.c…7.5
• CVE-2021-37808SQL Injection vulnerabilities exist in https://phpgurukul.co…5.9