File Browser is a file‑managing interface that allows uploading, deleting, previewing, renaming, and editing files within a specified directory. From version 2.0.0 through 2.33.8, its hook system – which runs administrator‑defined shell commands on file events such as upload, rename, and delete – is vulnerable to OS command injection. Variable placeholders like $FILE and $USERNAME are expanded via os.Expand without sanitization, so an attacker with permission to write to the monitored folder can craft a malicious filename containing shell metacharacters, causing the server to execute arbitrary OS commands and achieving remote code execution. The hook feature has been disabled by default in all installations from v2.33.8 onward, protecting newer deployments.

The flaw affects File Browser versions 2.0.0 through 2.33.8. In all releases prior to 2.33.8 the hook feature is enabled by default, while from 2.33.8 onward it is disabled. Existing installations that have not updated or that have not disabled the hook remain vulnerable, whereas fresh deployments of v2.33.8 or newer are not susceptible unless the option is re‑enabled.

The CVSS score is 7.5, indicating high severity, and the vulnerability is not listed in the CISA KEV catalog. Although the EPSS score indicates a low probability of exploitation (2%), the possibility of exploitation requires the attacker to write a file to a monitored directory, which is a common capability in many deployments. Given that the hook can trigger full command execution, the risk is significant for any system that still allows the hook mechanism to run; an attacker who succeeds would gain control of the host.