CVE-2026-34528

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips only Admin. The Execute permission and Commands list from the default user template are not stripped. When an administrator has enabled signup, server-side execution, and set Execute=true in the default user template, any unauthenticated user who self-registers inherits shell execution capabilities and can run arbitrary commands on the server. This issue has been patched in version 2.62.2.

• CWE-269

• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.2Product, Release Notes
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-x8jc-jvqm-pm3fExploit, Mitigation, Vendor Advisory
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-x8jc-jvqm-pm3fExploit, Mitigation, Vendor Advisory

Published

Apr 1, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34522SillyTavern is a locally installed user interface that allow…8.1
• CVE-2026-34523SillyTavern is a locally installed user interface that allow…5.3
• CVE-2026-34524SillyTavern is a locally installed user interface that allow…8.8
• CVE-2026-34525AIOHTTP is an asynchronous HTTP client/server framework for …5.3
• CVE-2026-34526SillyTavern is a locally installed user interface that allow…5
• CVE-2026-34527Sandboxie-Plus is an open source sandbox-based isolation sof…5.3
• CVE-2026-34529File Browser is a file managing interface for uploading, del…9
• CVE-2026-3453The ProfilePress plugin for WordPress is vulnerable to Insec…8.1
• CVE-2026-34530File Browser is a file managing interface for uploading, del…6.9
• CVE-2026-34531Flask-HTTPAuth provides Basic, Digest and Token HTTP authent…8.2
• CVE-2026-34532Parse Server is an open source backend that can be deployed …9.1
• CVE-2026-34533iccDEV provides a set of libraries and tools for working wit…5.5