{"action":"Upgrade github.com/filebrowser/filebrowser/v2 to 2.33.8 or later.","affected":[{"fixed":"2.33.8","introduced":"0"}],"component":"github.com/filebrowser/filebrowser/v2","cve_ids":["CVE-2025-52904"],"ecosystem":"Go","epss":0.01115,"exploited":false,"fixed_versions":["2.33.8"],"ghsa_id":"GHSA-hc8f-m8g5-8362","id":"tcs_01M5KFCAC18M30SCSN5RFWNF2D","modified_at":"2026-09-10T03:50:25.287186086Z","published_at":"2025-06-30T17:44:58Z","references":["https://osv.dev/vulnerability/GHSA-hc8f-m8g5-8362","https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hc8f-m8g5-8362","https://nvd.nist.gov/vuln/detail/CVE-2025-52904","https://github.com/filebrowser/filebrowser/issues/5199","https://github.com/GoogleContainerTools/distroless","https://github.com/filebrowser/filebrowser","https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250326-01_Filebrowser_Command_Execution_Not_Limited_To_Scope","https://pkg.go.dev/vuln/GO-2025-3793","https://sloonz.github.io/posts/sandboxing-1"],"severity":{"label":"high","score":8},"sources":[{"source":"osv","source_id":"GHSA-hc8f-m8g5-8362","url":"https://osv.dev/vulnerability/GHSA-hc8f-m8g5-8362"}],"summary":"File Browser: Command Execution not Limited to Scope"}