Attack Chain

1. A user attempts to access the File Browser interface via proxy authentication.
2. The File Browser instance, running a version prior to 2.63.1, authenticates the user through the proxy.
3. If the user does not already exist, the application automatically creates a new user account.
4. Due to the missing fix in the proxy authentication handler, the newly created user account is granted execution permissions.
5. The attacker leverages the granted execution permissions to execute arbitrary commands on the server.
6. These commands could be used to read sensitive files, modify system configurations, or install malicious software.
7. The attacker uses the file management interface to upload a malicious script.
8. The attacker executes the malicious script, achieving arbitrary code execution on the server, potentially leading to data exfiltration or system takeover.

Impact

Successful exploitation of CVE-2026-35607 allows unauthenticated or newly authenticated users to gain unauthorized execution privileges within the File Browser application. This can lead to the execution of arbitrary commands, potentially compromising the server hosting the application. The CVSS v3.1 base score for this vulnerability is 8.1, indicating a high level of severity. Depending on the server configuration, this could result in data breaches, system downtime, or complete system takeover.

Recommendation

• Upgrade File Browser to version 2.63.1 or later to remediate CVE-2026-35607.
• Implement the Sigma rule "Detect File Browser Unauthorized Command Execution" to identify potential exploitation attempts by monitoring for suspicious process creation events initiated by the File Browser process.
• Review and restrict the default execution permissions for File Browser to minimize the impact of potential exploits.
• Monitor web server logs for unusual activity associated with File Browser, specifically HTTP requests related to file uploads and execution.