https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:33:44 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-330611 EUVD-2026-330611 https://cve.radiocsirt.org/vuln/euvd-2026-330611 https://cve.radiocsirt.org/vuln/fkie_cve-2026-54090 <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured (e.g. /bin/sh -c), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell — semicolons, pipes, backticks, and $() all work to chain arbitrary commands after a permitted one. This vulnerability is fixed in 2.33.8.</p> <p>File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.33.8, when a shell interpreter is configured (e.g. /bin/sh -c), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell — semicolons, pipes, backticks, and $() all work to chain arbitrary commands after a permitted one. This vulnerability is fixed in 2.33.8.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-54090 https://cve.radiocsirt.org/vuln/ghsa-8c9q-7855-wfxq <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>&gt; [!NOTE] &gt; **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We&#39;re publishing this new advisory to make it clear that all vulnerabilities concerning this feature are disclosed. &gt; &gt; For more information about tracking vulnerability issues related to the Command Execution features, check https://github.com/filebrowser/filebrowser/issues/5199.</p> <p>## Summary</p> <p>When a shell interpreter is configured (e.g. `/bin/sh -c`), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell — semicolons, pipes, backticks, and `$()` all work to chain arbitrary commands after a permitted one.</p> <p>This is a distinct issue from CVE-2025-52995 (regex partial matching, fixed in 2.33.10) and CVE-2025-52903 (GTFOBins-style subcommands). The `slices.Contains` fix does not prevent this bypass.</p> <p>## Affected Location</p> <p>- `runner/parser.go`, function `ParseCommand` (lines 10-25) - `http/commands.go`, function `commandsHandler` (lines 72-86)</p> <p>## Root Cause</p> <p>`ParseCommand` extracts the first token via `SplitCommandAndArgs` for the allowlist check, then passes the entire raw input to the shell:</p> <p>```go func ParseCommand(s *settings.Settings, raw string) (command []string, name string, er…</p> <p><strong>Affected:</strong> Go: github.com/filebrowser/filebrowser/v2</p> <p>&gt; [!NOTE] &gt; **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We&#39;re publishing this new advisory to make it clear that all vulnerabilities concerning this feature are disclosed. &gt; &gt; For more information about tracking vulnerability issues related to the Command Execution features, check https://github.com/filebrowser/filebrowser/issues/5199.</p> <p>## Summary</p> <p>When a shell interpreter is configured (e.g. `/bin/sh -c`), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell — semicolons, pipes, backticks, and `$()` all work to chain arbitrary commands after a permitted one.</p> <p>This is a distinct issue from CVE-2025-52995 (regex partial matching, fixed in 2.33.10) and CVE-2025-52903 (GTFOBins-style subcommands). The `slices.Contains` fix does not prevent this bypass.</p> <p>## Affected Location</p> <p>- `runner/parser.go`, function `ParseCommand` (lines 10-25) - `http/commands.go`, function `commandsHandler` (lines 72-86)</p> <p>## Root Cause</p> <p>`ParseCommand` extracts the first token via `SplitCommandAndArgs` for the allowlist check, then passes the entire raw input to the shell:</p> <p>```go func ParseCommand(s *settings.Settings, raw string) (command []string, name string, er…</p> https://cve.radiocsirt.org/vuln/ghsa-8c9q-7855-wfxq