Go/github.com/filebrowser/filebrowser/v2 CVE-2026-35585: high 7.2, EPSS 2.00%

File Browser has a Command Injection via Hook Runner in github.com/filebrowser/filebrowser

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.33.8 or later.

go get github.com/filebrowser/filebrowser/v2@v2.33.8

Affected

Fixed versions

Sources

• osv: GO-2026-5481#Go/github.com/filebrowser/filebrowser/v2
• nvd: CVE-2026-35585
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-jvpw-637p-h3pw
• https://github.com/filebrowser/filebrowser/issues/5199

CVE-2026-35585 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:01:15.269292372Z · JSON