External risk intelligence

File Browser Pre-Authentication Command Injection

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-54088

File Browser is designed as a web-based file management interface, which is typically deployed as a public-facing web service to facilitate remote file access and management. The vulnerability exists in the login screen, which is an unauthenticated, internet-facing entry point by design for this product.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The File Browser software, used for managing files via a web interface, has a critical flaw in its authentication process. This issue allows unauthenticated attackers to execute arbitrary commands on the server before any login verification occurs, posing a significant security risk.

Flaw allows remote command execution on login.
Critical pre-authentication risk for web-accessible file managers.
Confirm relevance and exposure to potential unauthorized access.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this by sending specially crafted input to the login screen of the File Browser application. The application incorrectly processes user-supplied credentials, interpolating them into a system command without proper sanitization. This allows the attacker to inject commands that the server then executes, leading to arbitrary code execution before any authentication is even checked.

No authentication required to access.
User-supplied credentials trigger command execution.
Risk of arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

The File Browser's authentication mechanism, when configured to delegate login verification to an external shell command, could allow an unauthenticated remote attacker to execute arbitrary operating system commands on the server. This occurs when malicious shell metacharacters are injected into the username or password fields during login, bypassing authentication and potentially impacting the underlying server's integrity and available data.

Server OS commands could be executed.
Attacker exploits unauthenticated login.
Compromised server and data access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world action for this critical pre-authentication Remote Code Execution vulnerability rests with teams managing the File Browser application and its underlying infrastructure. The initial practical step is to identify all instances of File Browser, assess their exposure and business criticality, and then locate the accountable system owner to coordinate remediation or mitigation efforts.

Application and platform teams should own the issue.
Verify external reachability and business criticality.
Plan remediation or deploy compensating controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is File Browser?

File Browser is a web-based application that provides a graphical interface for managing files on a server. It allows users to perform common file operations such as uploading, deleting, renaming, and editing files directly through a web browser. Because it simplifies remote file management, it is often deployed to provide convenient access to directory structures over a network.

What does CWE-78 mean for CVE-2026-54088?

This vulnerability is classified as Improper Neutralization of Special Elements used in an OS Command, or CWE-78. In plain terms, the software fails to clean user input before using it to run system commands. Specifically, when the application uses an external shell command to verify logins, it takes the username or password and inserts them directly into a command string. Because it lacks sanitization, an attacker can input special characters to break out of the intended command and run their own.

How can an attacker trigger this command injection?

An attacker triggers this by entering specially crafted data into the username or password fields on the login screen. Since the application processes these fields before verifying identity, an attacker does not need an account or a valid password to succeed. Note that this bug is only triggered when the specific Hook Authentication feature—which relies on an external shell command—is enabled; if this feature is disabled or not in use, this specific injection path does not exist.

Is my instance of File Browser at risk?

If your File Browser instance is internet-facing, it is at higher risk because the login page acts as an unauthenticated entry point. Halo Surface Signal notes that File Browser is commonly deployed as a public-facing web service to facilitate remote management, meaning the affected login screen is frequently reachable from the internet. If your instance is exposed, assume that any remote user could potentially interact with the login screen to attempt this attack.

How do I respond to CVE-2026-54088?

The primary response is to update your File Browser installation to version 2.63.6 or later, which contains the fix for this issue. Before patching, identify all instances running in your environment and determine their business criticality. If you cannot update immediately, ensure the application is restricted from public internet access, though updating the software remains the only way to resolve the underlying vulnerability.

References

github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.