File Browser allows automated user creation through its proxy authentication handler. A regression in versions before 2.63.1 caused these auto‑provisioned accounts to receive execute permissions and command capabilities from global defaults, even though the signup route was corrected to remove such rights. This enables a malicious actor who can trigger a proxy‑auth login for a new user to gain the ability to run arbitrary commands on the server. The weakness is classified as an Improper Authorization issue (CWE‑269).

All deployments of File Browser running a version earlier than 2.63.1 are vulnerable, regardless of the specific installation method. The issue originates in the proxy authentication code path and affects automatically created user accounts. It does not affect pre‑existing accounts that were created through standard signup, nor versions 2.63.1 and newer.

The CVSS score of 8.1 indicates high severity. The EPSS score is less than 1% (0.00089), demonstrating a very low but non‑zero exploitation probability. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, suggesting there are no confirmed, widespread attacks yet. An attacker who can influence the proxy authentication flow could instantiate a privileged account and potentially execute code on the host. The vulnerability exists in a publicly accessible web interface and can be triggered by any proxy‑authenticated user.