CVE-2021-46398 is a Cross-Site Request Forgery (CSRF) vulnerability in Filebrowser versions prior to 2.18.0. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage, leading to the creation of a backdoor administrator account and subsequent Remote Code Execution (RCE) on the underlying system. This vulnerability carries a high CVSS score of 8.8, indicating a critical impact with high confidentiality, integrity, and availability compromise, requiring user interaction but no prior authentication. While not listed in CISA's KEV catalog and showing no active community discussion or media coverage, a public exploit (EDB-50717) exists, demonstrating its exploitability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2.18.0CPE matchmatch criteria | cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.