CVE-2025-52904 | File Browser: Command Execution not Limited to Scope

Exp

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In versions of the web application on the 2.x branch, all users have a scope assigned, and they only have access to the files within that scope. The Command Execution feature of Filebrowser allows the execution of shell commands which are not restricted to the scope, potentially giving an attacker read and write access to all files managed by the server. Until this issue is fixed, the maintainers recommend to completely disable `Execute commands` for all accounts. Since the command execution is an inherently dangerous feature that is not used by all deployments, it should be possible to completely disable it in the application's configuration. This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations. To exploit this vulnerability, the instance administrator must turn on a feature and ignore all the warnings about known vulnerabilities.

Published: 2025-06-26 Last update: 2026-06-09 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2025-52904 is rated High Exploit Risk (70.5/100): CVSS High severity, with medium exploitation likelihood (EPSS 0.56%). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2025-52904

EDB-ID Source Kind Published Link
nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2025-52904

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-09 1.15% 0.56% -0.58%
2 2026-04-22 0.38% 1.15% +0.77%
3 2026-03-22 0.38%

Full EPSS history (8 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2025-52904

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
8.0 3.1 HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:H)
Even with access, the exploit needs extra luck, timing, or a fussy environment to actually work.
Privileges required (PR:H)
They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C)
Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
1.3 6.0 [email protected]

Weakness enumeration for CVE-2025-52904

GitHub Security Advisory for CVE-2025-52904

GHSA-hc8f-m8g5-8362 · Severity: high · Ecosystem: go — File Browser: Command Execution not Limited to Scope

Affected software / configurations for CVE-2025-52904

Vendor Product Version Raw CPE
filebrowser filebrowser 2.32.0 cpe:2.3:a:filebrowser:filebrowser:2.32.0:*:*:*:*:*:*:*

References for CVE-2025-52904

cvelogic Threat Intelligence