Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
tes the semantics of `validateCommitment`, as this does not commitment to a block that is in the current chain. Because the digest is zero, it does not correspond to any block and there exist no known openings. As a result, this commitment will never be produced by a correct zkVM guest using Steel and leveraging this bug to compromise the soundness of a program using Steel would require a separate bug or misuse of the Steel library, which is expected to be used to validate the root of state opening proofs. A fix has been released as part of `risc0-ethereum` 2.1.1 and 2.2.0. Users for the `Steel` Solidity library versions 2.1.0 or earlier should ensure they are using `Steel.validateCommitment
Users for the `Steel` Solidity library versions 2.1.0 or earlier should ensure they are using `Steel.validateCommitment` in tandem with zkVM proof verification of a Steel program, as shown in the ERC-20 counter example, and documentation. This is the correct usage of Steel, and users following this pattern are not at risk, and do not need to take action. Users not verifying a zkVM proof of a Steel program should update their application to do so, as this is incorrect usage of Steel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/risc0/risc0-ethereum/security/advisories/GHSA-gjv3-89hh-9xq2 - https://github.com/risc0/risc0-ethereum/pull/605 - https://githu
isc0-ethereum/security/advisories/GHSA-gjv3-89hh-9xq2 - https://github.com/risc0/risc0-ethereum/pull/605 - https://github.com/risc0/risc0-ethereum/commit/3bbac859c7132b21ba5fdf2d47f1dd52e7e73d98 - https://docs.beboundless.xyz/developers/steel/how-it-works#verifying-the-proof-onchain - https://github.com/risc0/risc0-ethereum/blob/ff0cb9253a87945b653b825711b8b5075f8b7545/examples/erc20-counter/contracts/src/Counter.sol#L56-L63 - https://github.com/risc0/risc0-ethereum/releases/tag/v2.1.1 - https://github.com/risc0/risc0-ethereum/releases/tag/v2.2.0
CVE ID: CVE-2025-52885 State: PUBLISHED Published: 2025-10-10T22:11:20.494Z Last Updated: 2025-11-04T21:11:41.075Z Vendors: poppler Products: poppler Problem Types: CWE-416 Description: Poppler ia a library for rendering PDF files, and examining or modifying their structure. A use-after-free (write) vulnerability has been detected in versions Poppler prior to 25.10.0 within the StructTreeRoot class. The issue arises from the use of raw pointers to elements of a `std::vector`, which can lead to dangling pointers when the vector is resized. The vulnerability stems from the way that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid
y that refToParentMap stores references to `std::vector` elements using raw pointers. These pointers may become invalid when the vector is resized. This vulnerability is a common security problem involving the use of raw pointers to `std::vectors`. Internally, `std::vector `stores its elements in a dynamically allocated array. When the array reaches its capacity and a new element is added, the vector reallocates a larger block of memory and moves all the existing elements to the new location. At this point if any pointers to elements are stored before a resize occurs, they become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue. Additional Analy
become dangling pointers once the reallocation happens. Version 25.10.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2025-042_poppler/ - https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1884 - https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1884#note_3114334
CVE ID: CVE-2025-52886 State: PUBLISHED Published: 2025-07-02T15:46:49.733Z Last Updated: 2025-11-04T22:06:42.737Z Vendors: poppler Products: poppler Problem Types: CWE-416 Description: Poppler is a PDF rendering library. Versions prior to 25.06.0 use `std::atomic_int` for reference counting. Because `std::atomic_int` is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://securitylab.github.com/advisories/GHSL-2025-054_poppler/ - https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac2
/GHSL-2025-054_poppler/ - https://gitlab.freedesktop.org/poppler/poppler/-/commit/04bd91684ed41d67ae0f10cde0660e4ed74ac203 - https://gitlab.freedesktop.org/poppler/poppler/-/commit/ac36affcc8486de38e8905a8d6547a3464ff46e5 - https://gitlab.freedesktop.org/poppler/poppler/-/issues/1581 - https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/1828
CVE ID: CVE-2025-52887 State: PUBLISHED Published: 2025-06-26T14:31:52.092Z Last Updated: 2025-06-26T14:46:31.045Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: yhirose Products: cpp-httplib Problem Types: CWE-400 Description: cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. In version 0.21.0, when many http headers fields are passed in, the library does not limit the number of headers, and the memory associated with the headers will not be released when the connection is disconnected. This leads to potential exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the
l exhaustion of system memory and results in a server crash or unresponsiveness. Version 0.22.0 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-xjhg-gf59-p92h - https://github.com/yhirose/cpp-httplib/commit/28dcf379e82a2cdb544d812696a7fd46067eb7f9
CVE ID: CVE-2025-52888 State: PUBLISHED Published: 2025-06-24T19:45:22.854Z Last Updated: 2025-06-24T19:56:50.479Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: allure-framework Products: allure2 Problem Types: CWE-611 Description: Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xunit-xml-plugin used by Allure 2 prior to version 2.34.1. The plugin fails to securely configure the XML parser (`DocumentBuilderFactory`) and allows external entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file s
l entity expansion when processing test result .xml files. This allows attackers to read arbitrary files from the file system and potentially trigger server-side request forgery (SSRF). Version 2.34.1 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/allure-framework/allure2/security/advisories/GHSA-h7qf-qmf3-85qg - https://github.com/allure-framework/allure2/commit/cbcb33719851ff70adce85d38e15d20fc58d4eb7
CVE ID: CVE-2025-52889 State: PUBLISHED Published: 2025-06-25T16:49:00.442Z Last Updated: 2025-06-25T17:54:29.213Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L) Vendors: lxc Products: incus Problem Types: CWE-770 Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables rules for local services (DHCP, DNS...) that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe
ad to DHCP pool exhaustion and opens the door for other attacks. A patch is available at commit 2516fb19ad8428454cb4edfe70c0a5f0dc1da214. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lxc/incus/security/advisories/GHSA-9q7c-qmhm-jv86 - https://github.com/lxc/incus/commit/2516fb19ad8428454cb4edfe70c0a5f0dc1da214 - https://github.com/lxc/incus/commit/a7c33301738aede3c035063e973b1d885d9bac7c
CVE ID: CVE-2025-52890 State: PUBLISHED Published: 2025-06-25T16:51:24.279Z Last Updated: 2025-06-25T17:54:01.093Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:H) Vendors: lxc Products: incus Problem Types: CWE-863 Description: Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options `security.mac_filtering`, `security.ipv4_filtering` and `security.ipv6_filtering`. This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a p
and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp - https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8
CVE ID: CVE-2025-52891 State: PUBLISHED Published: 2025-07-02T15:03:34.068Z Last Updated: 2025-07-02T15:27:34.504Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: owasp-modsecurity Products: ModSecurity Problem Types: CWE-20 Description: ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. In versions 2.9.8 to before 2.9.11, an empty XML tag can cause a segmentation fault. If SecParseXmlIntoArgs is set to On or OnlyArgs, and the request type is application/xml, and at least one XML tag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaro
ag is empty (eg <foo></foo>), then a segmentation fault occurs. This issue has been patched in version 2.9.11. A workaround involves setting SecParseXmlIntoArgs to Off. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/owasp-modsecurity/ModSecurity/security/advisories/GHSA-gw9c-4wfm-vj3x - https://github.com/owasp-modsecurity/ModSecurity/commit/ecd7b9736836eee391d25f35d5bd06a3ce35a45d
CVE ID: CVE-2025-52892 State: PUBLISHED Published: 2025-08-05T00:17:16.047Z Last Updated: 2025-08-05T13:48:45.234Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: espocrm Products: espocrm Problem Types: CWE-444 Description: EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a user loads Espo in the browser with double slashes (e.g https://domain//#Admin) and the webserver does not strip the double slash, it can cause a corrupted Slim router's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7. Add
er's cache. This will make the instance unusable until there is a completed rebuild. This is fixed in version 9.1.7. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/espocrm/espocrm/security/advisories/GHSA-26x2-6wch-j8pf - https://github.com/espocrm/espocrm/commit/929611f317ce8892ea75873b0ab3094c0c510ff3
CVE ID: CVE-2025-52893 State: PUBLISHED Published: 2025-06-25T16:54:50.262Z Last Updated: 2025-06-25T20:39:04.734Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: openbao Products: openbao Problem Types: CWE-532 Description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 may leak sensitive information in logs when processing malformed data. This is separate from the earlier HCSEC-2025-09 / CVE-2025-4166. This issue has been fixed in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted r
in OpenBao v2.3.0 and later. Like with HCSEC-2025-09, there is no known workaround except to ensure properly formatted requests from all clients. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openbao/openbao/security/advisories/GHSA-8f5r-8cmq-7fmq - https://github.com/go-viper/mapstructure/pull/105 - https://github.com/go-viper/mapstructure/commit/ed3f92181528ff776a0324107b8b55026e93766a - https://github.com/openbao/openbao/commit/cf5e920badbf96b41253534a3fd5ff5063bf4b30 - https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 - https://github.com/go-vi
ensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 - https://github.com/go-viper/mapstructure/releases/tag/v2.3.0
CVE ID: CVE-2025-52894 State: PUBLISHED Published: 2025-06-25T16:59:02.058Z Last Updated: 2025-06-25T20:24:28.109Z Vendors: openbao Products: openbao Problem Types: CWE-20 Description: OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0 allowed an attacker to perform unauthenticated, unaudited cancellation of root rekey and recovery rekey operations, effecting a denial of service. In OpenBao v2.2.0 and later, manually setting the configuration option `disable_unauthed_rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available a
rekey_endpoints=true` allows an operator to deny these rarely-used endpoints on global listeners. A patch is available at commit fe75468822a22a88318c6079425357a02ae5b77b. In a future OpenBao release communicated on OpenBao's website, the maintainers will set this to `true` for all users and provide an authenticated alternative. As a workaround, if an active proxy or load balancer sits in front of OpenBao, an operator can deny requests to these endpoints from unauthorized IP ranges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/openbao/openbao/security/advisories/GHSA-prpj-rchp-9j5h - https://github.com/openbao/openbao/commit/fe75468822a22a88318c607942535
penbao/security/advisories/GHSA-prpj-rchp-9j5h - https://github.com/openbao/openbao/commit/fe75468822a22a88318c6079425357a02ae5b77b - https://openbao.org/docs/deprecation - https://openbao.org/docs/deprecation/unauthed-rekey
CVE ID: CVE-2025-52895 State: PUBLISHED Published: 2025-06-30T17:05:36.027Z Last Updated: 2025-06-30T20:40:43.365Z Vendors: frappe Products: frappe Problem Types: CWE-89 Description: Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, SQL injection could be achieved via a specially crafted request, which could allow malicious person to gain access to sensitive information. This issue has been patched in versions 14.94.3 and 15.58.0. There are no workarounds for this issue other than upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-mhj8-jfhf-mcw9 - https://github.com/frapp
hment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-mhj8-jfhf-mcw9 - https://github.com/frappe/frappe/pull/31526 - https://github.com/frappe/frappe/commit/c795e351be033070174437324d74f44759a744a6 - https://github.com/frappe/frappe/commit/f0933590103c80c6393647dd0403d399e64c951c
CVE ID: CVE-2025-52896 State: PUBLISHED Published: 2025-06-30T17:12:50.590Z Last Updated: 2025-06-30T20:39:38.755Z Vendors: frappe Products: frappe Problem Types: CWE-79 Description: Frappe is a full-stack web application framework. Prior to versions 14.94.2 and 15.57.0, authenticated users could upload carefully crafted malicious files via Data Import, leading to cross-site scripting (XSS). This issue has been patched in versions 14.94.2 and 15.57.0. There are no workarounds for this issue other than upgrading. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-hv29-66qg-2v6p - https://github.com/frappe/frappe/pull/3148
- https://github.com/frappe/frappe/security/advisories/GHSA-hv29-66qg-2v6p - https://github.com/frappe/frappe/pull/31483 - https://github.com/frappe/frappe/commit/152fd09de5bca16b8d299d715a1f5df6fca3866f - https://github.com/frappe/frappe/commit/f11c53d4df745b58bd1c1c08e1634a2f5a55322a
CVE ID: CVE-2025-52897 State: PUBLISHED Published: 2025-07-30T14:07:58.830Z Last Updated: 2025-07-30T19:28:12.527Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: glpi-project Products: glpi Problem Types: CWE-80, CWE-601 Description: GLPI is a Free Asset and IT Management Software package. In versions 9.1.0 through 10.0.18, an unauthenticated user can send a malicious link to attempt a phishing attack from the planning feature. This is fixed in version 10.0.19. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-6whm-q2rp-prqm
CVE ID: CVE-2025-52898 State: PUBLISHED Published: 2025-06-30T17:19:31.543Z Last Updated: 2025-06-30T18:01:16.717Z Vendors: frappe Products: frappe Problem Types: CWE-200 Description: Frappe is a full-stack web application framework. Prior to versions 14.94.3 and 15.58.0, a carefully crafted request could lead to a malicious actor getting access to a user's password reset token. This can only be exploited on self hosted instances configured in a certain way. Frappe Cloud users are safe. This issue has been patched in versions 14.94.3 and 15.58.0. Workarounds for this issue involve verifying password reset URLs before clicking on them or upgrading for self hosted users. Additional Analyst Not
involve verifying password reset URLs before clicking on them or upgrading for self hosted users. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-p284-r7rh-wq7j - https://github.com/frappe/frappe/pull/31522 - https://github.com/frappe/frappe/commit/52e31337a6c964189c8b883a2f7bc3a28ab374f2 - https://github.com/frappe/frappe/commit/5b4849b1ab5fd796b306312745b4e202b0e90d66
CVE ID: CVE-2025-52899 State: PUBLISHED Published: 2025-07-29T19:16:35.977Z Last Updated: 2025-07-29T19:34:26.472Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Enalean Products: tuleap Problem Types: CWE-204 Description: Tuleap is an Open Source Suite created to facilitate management of software development and collaboration. In Tuleap Community Edition prior to version 16.9.99.1750843170 and Tuleap Enterprise Edition prior to 16.8-4 and 16.9-2, the forgot password form allows for user enumeration. This is fixed in Tuleap Community Edition version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2. Additional Analyst Notes: - CISA ADP Vuln
on version 16.9.99.1750843170 and Tuleap Enterprise Edition 16.8-4 and 16.9-2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Enalean/tuleap/security/advisories/GHSA-xqf3-xxxf-x3c2 - https://github.com/Enalean/tuleap/commit/5c72d6d253016d38ed472eb7918f772d074ddb07 - https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=5c72d6d253016d38ed472eb7918f772d074ddb07 - https://tuleap.net/plugins/tracker/?aid=43674
CVE ID: CVE-2025-52900 State: PUBLISHED Published: 2025-06-26T14:35:50.452Z Last Updated: 2025-06-26T14:43:33.640Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: filebrowser Products: filebrowser Problem Types: CWE-276 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The file access permissions for files uploaded to or created from File Browser are never explicitly set by the application. The same is true for the database used by File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been
File Browser. On standard servers using File Browser prior to version 2.33.7 where the umask configuration has not been hardened before, this makes all the stated files readable by any operating system account. Version 2.33.7 fixes the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jj2r-455p-5gvf - https://github.com/filebrowser/filebrowser/commit/ca86f916216620365c0f81629c0934ce02574d76
CVE ID: CVE-2025-52901 State: PUBLISHED Published: 2025-06-30T19:56:25.114Z Last Updated: 2025-08-04T17:22:39.525Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: filebrowser Products: filebrowser Problem Types: CWE-598 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a session identifier will get leaked to anyone having access to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to
ess to the URLs accessed by the user. This will give an attacker full access to a user's account and, in consequence, to all sensitive files the user has access to. This issue has been patched in version 2.33.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-rmwh-g367-mj4x - https://github.com/filebrowser/filebrowser/commit/d5b39a14fd3fc0d1c364116b41289484df7c27b2 - https://github.com/filebrowser/filebrowser/releases/tag/v2.33.9 - https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250327-03_Filebrowser_Sensitive_Data_Transferred_In_URL
CVE ID: CVE-2025-52902 State: PUBLISHED Published: 2025-06-26T14:37:45.905Z Last Updated: 2025-06-26T15:01:19.861Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N) Vendors: filebrowser Products: filebrowser Problem Types: CWE-79, CWE-80 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. The Markdown preview function of File Browser prior to v2.33.7 is vulnerable to Stored Cross-Site-Scripting (XSS). Any JavaScript code that is part of a Markdown file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue. Additional Analys
file uploaded by a user will be executed by the browser. Version 2.33.7 contains a fix for the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4wx8-5gm2-2j97 - https://github.com/filebrowser/filebrowser/commit/f19943a42e8e092e811dffbe9f4623dac36f1f0d
CVE ID: CVE-2025-52903 State: PUBLISHED Published: 2025-06-26T18:16:32.203Z Last Updated: 2025-06-30T12:54:57.857Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: filebrowser Products: filebrowser Problem Types: CWE-77 Description: File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. In version 2.32.0, the Command Execution feature of File Browser only allows the execution of shell command which have been predefined on a user-specific allowlist. Many tools allow the execution of arbitrary different commands, rendering this limitation void. The concrete impact depends