CVE-2026-54088 File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)
Unauthenticated attackers can execute arbitrary OS commands via shell metacharacters in login credentials when the authentication hook feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-54088?
CVE-2026-54088 is a critical command injection vulnerability in filebrowser, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.
Which versions are affected by CVE-2026-54088?
4 open source packages ship an affected version, including github.com/filebrowser/filebrowser/v2 and github.com/filebrowser/filebrowser.
| Package | Affected | Fixed in |
|---|---|---|
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.6 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.6 |
github.com/filebrowser/filebrowser/v2 Go | All versions | 2.63.6 |
github.com/filebrowser/filebrowser Go | All versions | None |
How do I fix CVE-2026-54088?
Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.6 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-54088 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54088 exists.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-m93h-4hw7-5qcm, GO-2026-5962.