CVE-2026-35607: 
NixOS vulnerability analysis and mitigation

CVE-2026-35607 is an improper privilege management vulnerability in File Browser, a web-based file management interface, that allows proxy-authenticated users to inherit unintended execution capabilities upon auto-account creation. Affecting all versions up to and including 2.62.2 (and up to 2.63.0 per CPE data), the flaw was discovered and disclosed in April 2026, with the fix released in version 2.63.1. It is classified as High severity with a CVSS v3.1 base score of 8.8 per Feedly threat intelligence data (Feedly, Github Advisory).

The root cause (CWE-269: Improper Privilege Management) lies in an inconsistency between the signup handler and the proxy authentication handler in auth/proxy.go. When a prior fix (commit b6a4fb1) was applied to the signup handler to strip Execute permission and Commands from auto-provisioned users, the equivalent restriction was not applied to createUser() in the proxy auth handler — which calls setting.Defaults.Apply(user) without subsequently zeroing out user.Perm.Execute or user.Commands. As a result, any user auto-created on their first successful proxy-auth login inherits whatever execution capabilities the administrator has configured as global defaults, without any explicit admin grant. Exploitation requires proxy auth to be enabled (--auth.method=proxy), execution not disabled, and at least one command configured in global defaults (Github Advisory, PR #5890).

Successful exploitation allows an authenticated proxy-auth user to execute arbitrary commands on the File Browser host system — commands such as git, ls, cat, or id — that were never explicitly granted by an administrator. This constitutes a privilege escalation with high confidentiality, integrity, and availability impact, as command execution can be leveraged to read sensitive files, modify data, or disrupt service. The vulnerability is an incomplete fix for a prior related issue (GHSA-x8jc-jvqm-pm3f) and affects all proxy-auth deployments where default commands are configured (Github Advisory).

A concrete proof-of-concept using curl commands is publicly available in the GitHub Security Advisory, demonstrating how to auto-provision a proxy user and verify inherited execution permissions (Github Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.068% (0.000680), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA KEV catalog.

1. Reconnaissance: Identify a File Browser instance configured with proxy authentication (--auth.method=proxy) and default commands set (e.g., git,ls,cat,id). This can be inferred from exposed login pages or HTTP headers indicating proxy auth mode.
2. Trigger auto-provisioning: Send an HTTP request to the File Browser login API with a spoofed or controlled proxy header value for a username that does not yet exist in the system:

   curl -s http://HOST/api/login -H "X-Remote-User: newproxyuser"

   This causes File Browser to auto-create the account and return an auth token.
3. Obtain admin token: Authenticate as an existing admin user (if the attacker controls a valid proxy identity) to query user permissions:

   ADMIN_TOKEN=$(curl -s http://HOST/api/login -H "X-Remote-User: admin")

4. Verify inherited permissions: Confirm the newly created account has execute: true and the full commands list:

   curl -s http://HOST/api/users -H "X-Auth: $ADMIN_TOKEN" | jq '.[] | select(.username=="newproxyuser") | {execute: .perm.execute, commands}'

5. Execute arbitrary commands: Use the proxy user's token to invoke the File Browser command execution API with any of the inherited commands (e.g., id, cat /etc/passwd), achieving arbitrary command execution on the host (Github Advisory).

• Network: Unexpected HTTP requests to /api/login with unusual or newly seen X-Remote-User header values; repeated login attempts with different usernames via the proxy auth header from a single source IP.
• Logs: File Browser access logs showing new user creation events for accounts not previously known, particularly via the proxy auth path; API calls to /api/users shortly after a new proxy-auth login event.
• Application State: Presence of user accounts in the File Browser database with perm.execute = true and non-empty commands lists that were not explicitly created or modified by an administrator; accounts with lock_password = true (indicating auto-provisioning) that have execution rights.
• Process: Unexpected child processes spawned by the File Browser process corresponding to commands in the default command list (e.g., git, ls, cat, id) (Github Advisory).

Upgrade File Browser to version 2.63.1 or later, which applies the same permission restrictions to proxy-auth auto-provisioned users as the signup handler (stripping Admin, Execute, and Commands after applying defaults) (Github Advisory, PR #5890). If immediate patching is not possible, administrators should audit all existing proxy-auth auto-provisioned accounts and manually remove any Execute permissions and Commands entries that were not explicitly granted. As an additional workaround, clearing the global default commands list (--commands "") will prevent new proxy-auth users from inheriting execution capabilities until the patch can be applied.

The vulnerability was reported by security researcher kodareef5, who also submitted the fix via PR #5890, which was merged by maintainer hacdias on April 4, 2026 (PR #5890). The NixOS/nixpkgs project tracked the issue and opened a related update ticket (NixOS/nixpkgs#507902) shortly after disclosure. No significant broader media coverage or notable social media commentary beyond the GitHub advisory thread has been identified.