PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-35585 filebrowser CVE debrief

CVE-2026-35585 is a high-severity vulnerability in File Browser, a file managing interface, that allows for Remote Code Execution (RCE) via OS command injection. The vulnerability exists in versions 2.0.0 through 2.33.8 and is caused by the hook system's use of os.Expand without sanitization, allowing an attacker with file write permission to craft a malicious filename containing shell metacharacters. This results in the server executing arbitrary OS commands when the hook fires. The feature has been disabled by default for all installations from v2.33.8 onwards.

Vendor
filebrowser
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-07
Original CVE updated
2026-06-09
Advisory published
2026-04-07
Advisory updated
2026-06-09

Who should care

Users of File Browser, especially those with file write permission, should be aware of this vulnerability and take steps to mitigate it.

Technical summary

The vulnerability is caused by the hook system's use of os.Expand without sanitization, allowing an attacker with file write permission to craft a malicious filename containing shell metacharacters. This results in the server executing arbitrary OS commands when the hook fires.

Defensive priority

High

Recommended defensive actions

  • Upgrade to version 2.63.1 or later
  • Disable the hook system or use a sanitized version of os.Expand
  • Restrict file write permission to trusted users

Evidence notes

The vulnerability is documented in the CVE record and the NVD detail page. The vendor has also provided a patch and an advisory on GitHub.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-35585 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-35585

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-35585 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-35585

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.