8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34528

CVE-2026-34528: File Browser's Signup Grants Execution Permissions When Default Permissions Includes Execution

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to version 2.62.2, the signupHandler in File Browser applies default user permissions via d.settings.Defaults.Apply(user), then strips only Admin. The Execute permission and Commands list from the default user template are not stripped. When an administrator has enabled signup, server-side execution, and set Execute=true in the default user template, any unauthenticated user who self-registers inherits shell execution capabilities and can run arbitrary commands on the server. This issue has been patched in version 2.62.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34528

CVE-2026-34528:

8.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/filebrowser/filebrowser/v2	go	<= 2.62.1	2.62.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the user signup process where default permissions are not correctly sanitized. The http.signupHandler function in http/auth.go creates new users and applies default settings using settings.UserDefaults.Apply. The core of the vulnerability is that signupHandler failed to remove the Execute permission and Commands list after applying these defaults. This allows a newly registered user to inherit command execution capabilities if they are enabled in the default user template.

The patch, found in commit b6a4fb1f27f4d894b384c0f3acacda276d1338a5, directly addresses this by adding code to signupHandler to explicitly disable the Execute permission and clear the Commands list for any user created via the signup form.

An exploit would involve two main stages, reflected in the identified functions:

Creation of a privileged user: The attacker makes a request that is handled by http.signupHandler. This function calls settings.UserDefaults.Apply to copy the permissions, creating a user with command execution rights.
Command Execution: The attacker, now logged in as the new user, sends a command. This request is handled by http.commandsHandler, which checks the user's Execute permission. Since the permission was improperly granted during signup, the check passes, and the command is executed.

Vulnerable functions

http.signupHandler

http/auth.go

The `signupHandler` function is responsible for creating new users. It applies default permissions to the new user object but, prior to the patch, only stripped the `Admin` permission. It failed to strip the `Execute` permission and clear the `Commands` list. If the default user settings had `Execute` set to `true`, any user created through the signup form would inherit the ability to execute commands on the server, leading to remote code execution. The patch fixes this by explicitly setting `user.Perm.Execute = false` and `user.Commands = []string{}`.

settings.UserDefaults.Apply

settings/defaults.go

This function applies the default user settings, including the potentially dangerous `Execute` permission and the list of allowed `Commands`, to a new user object. The `signupHandler` calls this function. Because `signupHandler` did not subsequently clear the execution permissions, this function is a key part of the vulnerability chain.

http.commandsHandler

http/commands.go

This handler is responsible for executing commands sent by the user. It checks if the user has the `Execute` permission. During an exploit, this function would be called with a user who has inherited `Execute` permissions from the vulnerable `signupHandler`, allowing the execution of arbitrary commands. This function is where the inherited privilege is ultimately used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.