CVE-2026-54088: File Browser: OS command injection in Hook Authentication
File Browser versions before 2.63.6 pass login credentials unsanitized into an external shell command used by the Hook Authentication feature. The record describes this as an unauthenticated, pre-authentication remote code execution flaw rated critical (CVSS v4.0 9.3, CWE-78). Upgrading to 2.63.6 or later is the primary remediation.
Overview
File Browser is a web-based file management interface for uploading, deleting, previewing, renaming, and editing files inside a configured directory. According to the GitHub Security Advisory, its Hook Authentication feature lets administrators hand login verification to an external shell command, and user-supplied credentials are placed into that command string without sanitization. The advisory is tracked as CVE-2026-54088 and classified as OS command injection (CWE-78).
Impact
The record describes an unauthenticated remote attacker who can cause arbitrary operating system commands to run on the server before any authentication takes place. Because the flaw is reachable from the login screen, the potential impact is full compromise of confidentiality, integrity, and availability of the host running File Browser. The CVSS v4.0 base score of 9.3 supplied by the CNA reflects high impact on the vulnerable system.
Affected products and versions
- Product: File Browser (filebrowser/filebrowser)
- Affected versions: the description states versions prior to 2.63.6 are affected, with the Hook Authentication feature in use.
- Fixed version: 2.63.6, as stated in the description.
The structured affected and fixes fields in the record are empty, so the version range above is taken from the description text only.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted. The EPSS score is not available in the record.
Remediation and mitigation
- Upgrade File Browser to version 2.63.6 or later, as the vendor advisory indicates.
- If an immediate upgrade is not possible, disable the Hook Authentication feature if it is not required, which removes the vulnerable code path according to the description's account of how the feature works.
- Restrict network access to the File Browser login interface to trusted sources, reducing exposure of a pre-authentication flaw.
- Review whether File Browser instances run with privileges that limit what a compromised process could reach.
Detection guidance
- Review web server and application logs for login requests containing unusual shell-related characters in the username or password fields.
- Monitor the File Browser host for unexpected child processes spawned by the File Browser service account.
- Check for unexpected changes to files, accounts, or scheduled tasks on hosts where Hook Authentication was enabled before patching.
Limitations of the available information
The record provides a description, a CVSS 4.0 score from the GitHub CNA, and a CWE classification, but no structured affected or fixed version data, no KEV entry, and no EPSS score. The NVD entry was not separately confirmed in the record for scoring. Details of the vendor advisory beyond the description were not available in the record, so the exact exploit conditions and the full list of vulnerable configurations are unknown.
Frequently asked questions
What is the core issue in CVE-2026-54088?
According to the record, File Browser's Hook Authentication feature places login credentials into a shell command without sanitization, which allows OS command injection before authentication.
Which version fixes this vulnerability?
The description states that the vulnerability is fixed in File Browser 2.63.6, and versions prior to that are affected.
Is this vulnerability known to be actively exploited?
The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.