CVE-2025-52995

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.10, the implementation of the allowlist is erroneous, allowing a user to execute more shell commands than they are authorized for. The concrete impact of this vulnerability depends on the commands configured, and the binaries installed on the server or in the container image. Due to the missing separation of scopes on the OS-level, this could give an attacker access to all files managed the application, including the File Browser database. This issue has been patched in version 2.33.10.

• CWE-77

• https://github.com/filebrowser/filebrowser/commit/4d830f707fc4314741fd431e70c2ce50cd5a3108Patch
• https://github.com/filebrowser/filebrowser/releases/tag/v2.33.10Release Notes
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-w7qc-6grj-w7r8Exploit, Vendor Advisory

Published

Jun 30, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-52989An Improper Neutralization of Delimiters vulnerability in th…6.8
• CVE-2025-5299A vulnerability was found in SourceCodester Client Database …7.3
• CVE-2025-52991The Nix, Lix, and Guix package managers default to using tem…3.2
• CVE-2025-52992The Nix, Lix, and Guix package managers fail to properly set…3.2
• CVE-2025-52993A race condition in the Nix, Lix, and Guix package managers …5.6
• CVE-2025-52994gif_outputAsJpeg in phpThumb through 1.7.23 allows phpthumb.…4.9
• CVE-2025-52996File Browser provides a file managing interface within a spe…4.3
• CVE-2025-52997File Browser provides a file managing interface within a spe…7.5
• CVE-2025-52998Chamilo is a learning management system. Prior to version 1.…9.8
• CVE-2025-52999jackson-core contains core low-level incremental ("streaming…8.7
• CVE-2025-53000The nbconvert tool, jupyter nbconvert, converts Jupyter note…7.8
• CVE-2025-53001Rejected reason: Reason: This candidate was issued in error.