CVE-2026-34528 - Vulnerability Analysis

Overview

File Browser < 2.62.2 contains a command injection caused by improper default user permission handling in signupHandler, letting unauthenticated users who self-register execute arbitrary commands on the server, exploit requires signup enabled with Execute permission set.

Severity & Score

Impact

Unauthenticated users can execute arbitrary commands on the server, leading to full server compromise.

Mitigation

Upgrade to version 2.62.2 or later.

References

• https://github.com/filebrowser/filebrowser/releases/tag/v2.62.2
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-x8jc-jvqm-pm3f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner