OS Command Injection in FileBrowser - CVE-2026-54088
Published: June 8, 2026
Vulnerability identifier: #VU133481
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-54088
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary os commands.
The vulnerability exists due to command injection in HookAuth.RunCommand in auth/hook.go when processing login requests through the hook authentication feature. A remote attacker can send a specially crafted username or password value to execute arbitrary os commands.
Only instances with the hook authentication feature enabled are vulnerable, and exploitation occurs before authentication is completed.
Affected software
FileBrowser
How to mitigate CVE-2026-54088
Install security update from vendor's website.
FileBrowser - update to 2.63.6