Is CVE-2026-54088 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54088 being exploited in the wild.

How severe is CVE-2026-54088?

Critical severity, with a CVSS score of 4, published 25 June 2026.

Which products and versions are affected?

File Browser < 2.63.6, <= 2.63.5; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.

Is there a fix for CVE-2026-54088?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54088 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-54088?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54088: File Browser OS command injection in Hook Authentication

Q: Which products and versions are affected?

File Browser < 2.63.6, <= 2.63.5; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.

Q: Is there a fix for CVE-2026-54088?

Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54088 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-54088?

Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54088 · Severity: critical · CVSS 4 · Published 2026-06-25

File Browser is a web-based file management utility. A critical vulnerability in its 'Hook Authentication' feature allows an unauthenticated attacker to take complete control of the server by sending a specially crafted login request. This could lead to total data theft, service disruption, or the installation of persistent malware on the host system.

Technologies: File Browser, github.com/filebrowser/filebrowser (Go), github.com/filebrowser/filebrowser/v2 (Go). Vendors: File Browser, Go.

Quick answers

Is CVE-2026-54088 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54088 being exploited in the wild.
How severe is CVE-2026-54088?: Critical severity, with a CVSS score of 4, published 25 June 2026.
Which products and versions are affected?: File Browser < 2.63.6, <= 2.63.5; github.com/filebrowser/filebrowser (Go) SEMVER:introduced=0; github.com/filebrowser/filebrowser/v2 (Go) <= 2.63.5, SEMVER:introduced=0,fixed=2.63.6.
Is there a fix for CVE-2026-54088?: Yes. github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54088 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-54088?: Check whether you run File Browser, github.com/filebrowser/filebrowser (Go) or github.com/filebrowser/filebrowser/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/filebrowser/filebrowser/v2 (Go): upgrade to 2.63.6 or later
```
go get github.com/filebrowser/filebrowser/v2@v2.63.6
```

Technical details

A command injection vulnerability exists in the Hook Authentication feature of File Browser due to improper neutralization of shell metacharacters. The 'HookAuth.RunCommand' function uses 'os.Expand' to interpolate user-supplied usernames and passwords directly into a shell command string without sanitization or escaping. An unauthenticated remote attacker can exploit this by submitting a crafted username containing shell delimiters (e.g., semicolons) via the login endpoint. This results in arbitrary OS command execution with the privileges of the File Browser process. The issue is patched in version 2.63.6.

Affected products

filebrowser File Browser <= 2.63.5

Identifiers

CVE-2026-54088
GHSA-m93h-4hw7-5qcm
GO-2026-5962

Timeline

2026-06-03: disclosed
2026-06-03: patched: Fixed in version 2.63.6
2026-07-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.