CVE Feed

    Dashboard / CVE / CVE-2021-46398

    CVE-2021-46398

    A Cross-Site Request Forgery vulnerability exists in Filebrowser < 2.18.0 that allows attackers to create a backdoor user with admin privilege and get access to the filesystem via a malicious HTML webpage that is sent to the victim. An admin can run commands using the FileBrowser and hence it leads to RCE.

    Published:Feb 4, 2022
    Last Modified:Nov 21, 2024
    EPS:Feb 4, 2022
    EPSS Score:0.09247
    CVSS Score:8.8

    Affected Products

    Vendor
    Filebrowser
    Product
    Filebrowser

    Exploits

    http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.htmlhttps://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.htmlhttps://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.htmlhttps://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.htmlhttps://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7https://www.exploit-db.com/exploits/50717https://github.com/febinrev/CVE-2021-46398_Chamilo-LMS-RCEhttps://github.com/LalieA/CVE-2021-46398

    Related CVEs

    CVE-2026-82238 (CVSS 2.3) — filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated …
    CVE-2026-82237 (CVSS 2.3) — filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion trigger…
    CVE-2026-82236 (CVSS 2.3) — File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user d…
    CVE-2026-82235 (CVSS 8.2) — filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, a…
    CVE-2026-62684 (CVSS 2.7) — File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files wit…
    CVE-2026-72838 (CVSS 7.1) — FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PAT…
    CVE-2026-72837 (CVSS 8.7) — File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authenticatio…
    CVE-2026-72836 (CVSS 9.2) — FileBrowser before 2.63.19 does not account for case-insensitive filesystems when checking home directory owne…
    CVE-2026-72835 (CVSS 7.6) — filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authe…
    CVE-2026-72834 (CVSS 5.3) — filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum (?checksu…

    References

    http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html
    https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html
    https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/
    https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
    https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d
    https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
    http://packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html
    https://febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html
    https://febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/
    https://febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
    https://github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d
    https://systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High