File Browser allows users to manage files through a web interface, and prior to version 2.33.8 an allowlist of permitted shell commands was enforced only on the first token of user‑supplied input. The remainder of the input was passed directly to the configured shell, enabling a command injection flaw identified as CWE‑184 and CWE‑77. By exploiting shell metacharacters such as semicolons, pipes, backticks, or $(), an attacker can append arbitrary commands to a permitted one and execute them under the privileges of the File Browser process. This results in remote code execution on the host controlling the web interface, potentially giving full system compromise.

The vulnerability affects the File Browser application provided by the vendor filebrowser. Any deployment running File Browser version 2.33.7 or earlier, when a shell interpreter such as /bin/sh -c is configured, is susceptible. Versions 2.33.8 and newer contain the fix and are not affected.

The CVSS score of 8.7 rates this flaw as High severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The attack likely requires that the user submit input through the web interface and that the File Browser configuration allows shell execution. An attacker who can control the command string can bypass the allowlist and chain malicious commands, leading to full compromise of the underlying host.