CVE-2026-34528 is a high severity (CVSS 8.1) flaw in File Browser before 2.62.2. When signup, server-side commands and Execute in the default user template are all on, a self-registered user inherits command execution. Upgrade to 2.62.2 or later. Turn signup off if you do not need it.
What's affected
The project's advisory (GHSA-x8jc-jvqm-pm3f) lists the Go module github.com/filebrowser/filebrowser/v2 at 2.62.1 and earlier, with 2.62.2 as the patched release.
The flaw needs a specific configuration: an administrator has enabled signup, enabled server-side execution, and set Execute to true in the default user template. In that case the signup handler copies the default permissions to the new user and then strips only Admin. The Execute permission and the commands list are kept, so any unauthenticated visitor who registers can run commands on the server.
Instances that keep signup off, or keep Execute off in the defaults, do not match the described condition.
How to check if you're exposed
filebrowser version
Compare it with 2.62.2. Then check the three settings. In the admin settings, see whether user signup is on, whether command execution is enabled, and whether the default user template has Execute and any commands set. Review the user list for accounts you did not create.
Also check the default user template in the admin settings, since new users take their rights from it. If Execute or a command list is set there, clear it unless you have a firm need.
What to do now
- Upgrade to File Browser 2.62.2 or later.
- Turn off signup unless you need it.
- Remove Execute and the commands list from the default user template.
- Review the user list and delete accounts you do not recognize.
- Run the service as a low-privilege user, and limit what it can read.
Why it matters
The weakness is CWE-269, improper privilege management. Default settings meant for trusted users were applied to people anyone on the internet could create. The code removed the one flag it remembered, Admin, and not the rest.
The lesson for any self-service signup: start from a minimal permission set for new accounts, not a copy of the template for existing users. The CVSS vector shows high attack complexity, because the configuration has to be unusual. The record does not mark the CVE as exploited, and it is not on the CISA KEV list.
Server-side command execution in a file manager is a feature that most deployments do not need. If you do not use it, turn it off at the server level. A feature that is disabled cannot be inherited by mistake.
One more habit helps with any app that offers self-service signup: create a test account after each upgrade and check what it can do. An account that should be able to view files and nothing else should fail every attempt to run a command. Put that check in your upgrade checklist, since defaults can change between releases and a default that was safe last year may not be safe now. If other people share the instance, tell them about the change, because turning off signup may affect colleagues who used it.
Quick check
Am I affected with signup turned off?
Not by the configuration the advisory describes, but upgrade anyway.
Sources
Last reviewed: 19 October 2026.
