CVE-2026-54088

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.

• CWE-78
• CWE-88
• CWE-306

• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm

Published

Jun 25, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-54078veraPDF validation model is an implementation of the veraPDF…8.7
• CVE-2026-54079veraPDF validation provides PDF/A and PDF/UA validation, fea…8.7
• CVE-2026-5408BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
• CVE-2026-54080veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54081veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.3…6.9
• CVE-2026-54082veraPDF validation model is an implementation of the veraPDF…6.5
• CVE-2026-54089File Browser is a file managing interface for uploading, del…9.1
• CVE-2026-5409Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 …5.5
• CVE-2026-54090File Browser is a file managing interface for uploading, del…8.7
• CVE-2026-54091File Browser is a file managing interface for uploading, del…7.5
• CVE-2026-54092File Browser is a file managing interface for uploading, del…6.5
• CVE-2026-54093File Browser is a file managing interface for uploading, del…6.8