Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-12 | 2 | General1Patch1 |
| 2026-06-26 | 1 | Patch1 |
| 2026-07-10 | 1 | Disclosure1 |
CVE-2026-54088 File Browser Hook Authentication のプリ認証 OS コマンドインジェクション cvss 9.3 critical https://saku0512.com/cve/cve-2026-54088 2.63.6で修正されました
Post summary
The post announces CVE‑2026‑54088 as a critical OS command‑injection issue, provides a link for more details, notes pre‑authentication exploitation, and indicates the vulnerability was fixed in version 2.63.6.
🔴 File Browser, #OS Command Injection, #CVE-2026-54088 (Critical) -DC-Jul2026-871 https://dailycve.com/file-browser-os-command-injection-cve-2026-54088-critical-dc-jul2026-871/
Post summary
The post links to a DailyCVE article announcing a critical OS Command Injection vulnerability (CVE‑2026‑54088) in File Browser, with no indication of PoC, exploit tools, or active exploitation.
🚨 CRITICAL - Pre-auth command injection in File Browser Hook Authentication (CVE-2026-54088) File Browser’s Hook Authentication feature (filebrowser before 2.63.6) builds an external shell command by interpolating the supplied username and password via os.Expand, allowing untrusted data to reach command execution. The root cause is improper input sanitization leading to OS command injection (shell metacharacter injection) when constructing shell commands. An unauthenticated attacker can exploit this remotely by submitting crafted login fields containing shell metacharacters, triggering arbitrary command execution before authentication completes. Impact is critical pre-auth remote code execution, enabling full server compromise, data theft, lateral movement, and service disruption. 👉 Affected: filebrowser < 2.63.6 | Upgrade to 2.63.6
Post summary
Vulnerability CVE-2026-54088 in File Browser before 2.63.6 enables pre‑authentication command injection; upgrading to 2.63.6 applies the required patch.
CVE-2026-54088 CVE-2026-54088 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-54088
Post summary
The entry simply lists CVE-2026-54088 twice and provides a link to an external vulnerability detail page, offering no additional context or actionable information.