Detections
Analytics

SCA: security update for github.com/filebrowser/filebrowser/v2 (GHSA-jvpw-637p-h3pw)

high Tenable Self-Hosted Container Security Plugin ID 442852

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files
 within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes
 administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to
 OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand
 without sanitization. An attacker with file write permission can craft a malicious filename containing
 shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This
 results in Remote Code Execution (RCE). This feature has been disabled by default for all installations
 from v2.33.8 onwards, including for existent installations. (CVE-2026-35585)

Solution

Update the github.com/filebrowser/filebrowser/v2 library and its related packages to version 2.33.8 or later.

See Also

https://github.com/advisories/GHSA-jvpw-637p-h3pw

Plugin Details

Severity: High

ID: 442852

Version: Revision 1.4

Type: Local

Family: SCA Checks

Published: 6/9/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.95

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 8.3

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:C

CVSS Score Source: CVE-2026-35585

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 7.5

Threat Score: 7.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/8/2026

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-35585