CVE-2026-34528CWE-269

File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

High · published April 1, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips only Admin. The Execute permission and Commands list from the default user template are not stripped. When an administrator has enabled signup, server-side execution, and set Execute=true in the default user template, any unauthenticated user who self-registers inherits shell execution capabilities and can run arbitrary commands on the server. This issue has been patched in version 2.62.2.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-04-01T20:39Z
EPSS history
Timeline
  • 01 APR 20:39Z
    File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution
    cvelistv5