Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 until 2.33.8, the hook system in File Browser — which executes administrator-defined shell commands on file events such as upload, rename, and delete — is vulnerable to OS command injection. Variable substitution for values like $FILE and $USERNAME is performed via os.Expand without sanitization. An attacker with file write permission can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands when the hook fires. This results in Remote Code Execution (RCE). This feature has been disabled by default for all installations from v2.33.8 onwards, including for existent installations.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-07 | 2 | General2 |
| 2026-04-14 | 1 | Patch1 |
https://www.cve.org/CVERecord?id=CVE-2026-35585 初CVE取得!!!! File Browser におけるOSコマンドインジェクション v2.0.0 から v2.63.1まで影響 v2.33.8以降(または最新版)へのアップデートを推奨 修正版では対象となるフック機能がデフォルトで無効化されている
Post summary
File Browser v2.0.0–v2.63.1 contain an OS command injection; updating to 2.33.8 or later mitigates the risk.
🚨*CVE* CVE-2026-35585 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 through 2.63.1, th… https://www.cve.org/CVERecord?id=CVE-2026-35585 ----- Traducción: CVE-2026-35585 Fil… http://infoflow.cloud`
Post summary
The tweet provides a link to the CVE record and a short product description but offers no additional technical, exploit, or patch information.
CVE-2026-35585 File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. From 2.0.0 through 2.63.1, th… https://www.cve.org/CVERecord?id=CVE-2026-35585
Post summary
The text merely references CVE-2026-35585 with a link to the official record, lacking any PoC, exploit, patch, or technical specifics, thus it is a general mention.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | filebrowser | filebrowser | - | - | - |