What’s Vulnerable › Vulnerabilities

CVE-2021-37794

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-08-31 · updated 2026-06-17
• Weakness: CWE-79

Description

A stored cross-site scripting (XSS) vulnerability exists in FileBrowser < v2.16.0 that allows an authenticated user authorized to upload a malicious .svg file which acts as a stored XSS payload. If this stored XSS payload is triggered by an administrator it will trigger malicious OS commands on the server running the FileBrowser instance.

Affected products

• Filebrowser Project Filebrowser: before 2.16.0 — fixed in 2.16.0

How to fix

Upgrade to a fixed version: Filebrowser Project Filebrowser 2.16.0. Check the vendor advisory for mitigations.

References

• https://gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5c
• https://github.com/filebrowser/filebrowser
• https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbd
• https://gist.github.com/omriinbar/1e28649f31d795b0e9b7698a9d255b5c
• https://github.com/filebrowser/filebrowser
• https://github.com/filebrowser/filebrowser/commit/201329abce4e92ae9071b9ded81e267aae159fbd

Get alerted when CVE-2021-37794 or the next vulnerability affects your stack