CVE-2026-54088: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Synopsis

This is a command injection vulnerability in File Browser, a web-based file management interface. An unauthenticated remote attacker can send crafted username or password values containing shell metacharacters to the login endpoint; the server passes those values unsanitized into an OS command string via the Hook Authentication feature, executing arbitrary commands before any login check runs. Successful exploitation gives the attacker full remote code execution on the host running File Browser. No patched release has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the File Browser login endpoint over the network; the vulnerable code path is exposed on the HTTP/HTTPS interface without any prior connection filtering.

• AuthenticationNot required

  No credentials or account of any kind are needed; the injection occurs in the unauthenticated login request itself, before any credential check runs.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted HTTP request directly to the server and the command executes automatically.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the attacker simply includes shell metacharacters in a standard login request with no need to time a race condition or satisfy environmental prerequisites.

Blast Radius

• The attacker executes arbitrary OS commands as the user running the File Browser process, with full access to the underlying shell environment.
• All files within the directory served by File Browser are readable and writable, including any secrets, configuration files, or uploaded user data stored there.
• The attacker can write to or delete any file the server process can reach, corrupting data or planting backdoors on the host filesystem.
• The server process and any services reachable from it can be terminated or manipulated, causing a full service outage for File Browser and any dependent workflows.