GitHub Security Advisory: GHSA-x8jc-jvqm-pm3f
Package: github.com/filebrowser/filebrowser/v2 (GO)
Severity: HIGH (CVSS 8.1)
CWE: CWE-269: Improper Privilege Management
Vulnerable versions: <= 2.62.1
Patched in: 2.62.2

Summary: File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

Details:
## Summary

The `signupHandler` in File Browser applies default user permissions via `d.settings.Defaults.Apply(user)`, then strips only `Admin` (commit `a63573b`). The `Execute` permission and `Commands` list from the default user template are **not** stripped. When an administrator has enabled signup, server-side execution, and set `Execute=true` in the default user template, any unauthenticated user who self-registers inherits shell execution capabilities and can run arbitrary commands on the server.

## Details

### Root Cause

`signupHandler` at `http/auth.go:167–172` applies all default permissions before stripping only `Admin`:

```go
// http/auth.go
d.settings.Defaults.Apply(user)   // copies ALL permissions from defaults

// Only Admin is stripped — Execute, Commands are still inherited
user.Perm.Admin = false
// user.Perm.Execute remains true if set in defaults
// user.Commands remains populated if set in defaults
```

`settings/defaults.go:31–33` confirms `Apply` copies the full permissions struct including Execute and Commands:

```go
func (d *UserDefaults) Apply(u *users.User) {
    u.Perm = d.Perm          // includes Execute
    u.Commands = d.Commands  // includes allowed shell commands
    // ...
}
```

The `commandsHandler` at `http/commands.go:63–66` checks both the server-wide `EnableExec` flag and `d.user.Perm.Execute`:

```go
if !d.server.EnableExec || !d.user.Perm.Execute {
    // writes "Command not allowed." and returns
}
```

The `withUser` middleware reads `d.user` from the database at request time (`http/auth.go:103`), so the persisted `Execute=true` and `Commands` values from signup are authoritative. The command allowlist check at `commands.go:80` passes because the user's `Commands` list contains the inherited default commands:

```go
if !slices.Contains(d.user.Commands, name) {
    // writes "Command not allowed." and returns
}
```

### Execution Flow

1. Admin configures: `Signup=true`, `EnableExec=true`, `Defaults.Perm.Execute=true`, `Defaults.Commands=["bash"]`
2. Unauthenticated attacker POSTs to `/api/signup` → new user created with `Execute=true`, `Commands=["bash"]`
3. Attacker logs in → receives JWT with valid user ID
4. Attacker opens WebSocket to `/api/command/` → `withUser` fetches user from DB, `Execute=true` passes check
5. Attacker sends `bash` over WebSocket → `exec.Command("bash")` is invoked → arbitrary shell execution

This is a direct consequence of the incomplete fix in commit `a63573b` (CVE-2026-32760 / GHSA-5gg9-5g7w-hm73), which applied the same rationale ("signup users should not inherit privileged defaults") only to `Admin`, not to `Execute` and `Commands`.

## PoC

```bash
TARGET="http://localhost:8080"

# Step 1: Self-register (no authentication required)
curl -s -X POST "$TARGET/api/signup" \
  -H "Content-Type: application/json" \
  -d '{"username":"attacker","password":"AttackerP@ss1!"}'
# Returns: 200 OK

# Step 2: Log in and capture token
TOKEN=$(curl -s -X POST "$TARGET/api/login" \