CVE-2021-46398

🗓️ 04 Feb 2022 15:05:05Reported by mitreType

cve🔗 web.nvd.nist.gov👁 100 Views🌐 WEB

A CSRF vulnerability in Filebrowser < 2.18.0 allows attackers to create a backdoor user with admin privilege

Reporter	Title	Published	Views	Family All 20
zdt	FileBrowser 2.17.2 - Cross Site Request Forgery to Remote Code Execution Vulnerability	8 Feb 202200:00	–	zdt
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Filebrowser	3 Jan 202309:49	–	githubexploit
GithubExploit	Exploit for Cross-Site Request Forgery (CSRF) in Filebrowser	22 Mar 202217:35	–	githubexploit
attackerkb	CVE-2021-46398	4 Feb 202216:15	–	attackerkb
Circl	CVE-2021-46398	4 Feb 202218:30	–	circl
CNNVD	FileBrowser 跨站请求伪造漏洞	4 Feb 202200:00	–	cnnvd
CNVD	FileBrowser Cross-Site Request Forgery Vulnerability	21 Feb 202200:00	–	cnvd
Cvelist	CVE-2021-46398	4 Feb 202215:05	–	cvelist
Exploit DB	FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE)	8 Feb 202200:00	–	exploitdb
EUVD	EUVD-2022-0876	3 Oct 202520:07	–	euvd

NVD

Node

filebrowser filebrowserRange<2.18.0

Source	Link
packetstormsecurity	www.packetstormsecurity.com/files/165885/FileBrowser-2.17.2-Code-Execution-Cross-Site-Request-Forgery.html
github	www.github.com/filebrowser/filebrowser/commit/74b7cd8e81840537a8206317344f118093153e8d
febin0x4e4a	www.febin0x4e4a.wordpress.com/2022/01/19/critical-csrf-in-filebrowser/
febin0x4e4a	www.febin0x4e4a.blogspot.com/2022/01/critical-csrf-in-filebrowser.html
systemweakness	www.systemweakness.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7
febinj	www.febinj.medium.com/critical-csrf-to-rce-in-filebrowser-865a3c34b8e7

Parameter	Position	Path	Description	CWE
what	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
which	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.scope	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.locale	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.viewMode	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.singleClick	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.sorting.by	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.sorting.asc	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.perm.admin	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352
data.perm.execute	request body	/api/users	CSRF to RCE via /api/users: creates an admin backdoor user by sending a crafted JSON payload exploiting missing CSRF protection and content-type validation.	CWE-352

17 Jun 2026 04:14Current

8.4High risk

Vulners AI Score8.4

CVSS 26.8

CVSS 3.18.8

EPSS0.06663

CWE-352