CVE-2026-54088: File Browser OS command injection in Hook Authentication

Executive brief

File Browser is a web-based file management utility. A critical vulnerability in its 'Hook Authentication' feature allows an unauthenticated attacker to take complete control of the server by sending a specially crafted login request. This could lead to total data theft, service disruption, or the installation of persistent malware on the host system.

Technical details

A command injection vulnerability exists in the Hook Authentication feature of File Browser due to improper neutralization of shell metacharacters. The 'HookAuth.RunCommand' function uses 'os.Expand' to interpolate user-supplied usernames and passwords directly into a shell command string without sanitization or escaping. An unauthenticated remote attacker can exploit this by submitting a crafted username containing shell delimiters (e.g., semicolons) via the login endpoint. This results in arbitrary OS command execution with the privileges of the File Browser process. The issue is patched in version 2.63.6.

Affected products

• filebrowser File Browser <= 2.63.5

Timeline

• 2026-06-03: disclosed
• 2026-06-03: patched: Fixed in version 2.63.6
• 2026-07-10: advisory

References

• https://api.github.com/users/Saku0512
• https://github.com/Saku0512
• https://api.github.com/users/Saku0512/gists%7B/gist_id%7D
• https://api.github.com/users/Saku0512/repos
• https://avatars.githubusercontent.com/u/133749072?v=4
• https://api.github.com/users/Saku0512/events%7B/privacy%7D