External risk intelligence

File Browser Proxy Authentication Impersonation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-54089

File Browser is designed as a web-based file management interface. When deployed, it acts as a web application that is often exposed to the network or internet to allow remote file access, management, and uploads, making it a common target for public-facing web service exposure.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects File Browser, a web-based file management tool, when configured for proxy authentication. An unauthenticated attacker can impersonate any user, including administrators, by sending a forged HTTP header, and can also create new user accounts without authorization. The primary concern is to confirm if this tool is in use and, if so, whether it is configured with proxy authentication to assess potential exposure.

Allows impersonation and unauthorized account creation.
Impacts systems using proxy authentication.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker who can reach the File Browser server can impersonate any user, including an administrator, by sending a specially crafted HTTP header. This bypasses the need for credentials and allows the attacker to take over user accounts or create new ones without authorization, leading to significant control over the system.

Attacker can reach the server.
Attacker sends a forged HTTP header.
Full account takeover and creation.

Live Threat

Current exploitation, exposure, and threat context

When File Browser is configured with proxy authentication, an unauthenticated attacker could impersonate any user, including an administrator, by sending a forged HTTP header. This vulnerability also allows for the creation of new user accounts without authorization.

File management access and user accounts.
Forged HTTP header impersonation.
Unauthorized access and user creation.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in File Browser, when configured with proxy authentication, allows unauthenticated attackers to impersonate any user, including administrators, and create new accounts without authorization by sending a forged HTTP header. The first step for any team is to locate all instances of File Browser, determine their reachability and business criticality, identify the accountable owner, and then plan remediation based on the assessed risk.

Identify application owners and infrastructure.
Verify proxy authentication configuration and reachability.
Plan remediation during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is File Browser?

File Browser is a web-based interface that allows users to manage files on a server. It provides tools to upload, delete, preview, rename, and edit files directly within a designated directory through a browser, acting as a centralized file management system.

Why is CVE-2026-54089 considered a security risk?

This vulnerability involves Improper Authentication (CWE-287) and Authentication Bypass by Spoofing (CWE-290). When using proxy authentication, the software trusts HTTP headers provided by the requester without verification. An attacker can manipulate these headers to impersonate any user, including administrators, or even force the system to create unauthorized new accounts.

How does an attacker trigger this vulnerability?

An attacker triggers the flaw by sending a specifically forged HTTP header to the server. This bypasses standard login procedures. It is important to note that if your File Browser instance is not configured to use proxy authentication, or if it is configured to use other authentication methods, this specific bypass vector does not apply.

Is my environment at risk from this vulnerability?

According to Halo Surface Signal, this risk is relevant if your File Browser instance is network-accessible. Because the software is designed to provide remote file access, it is frequently deployed in ways that allow internet or network-wide reachability. If your instance is reachable by untrusted parties, the potential for unauthorized access via forged headers increases.

What steps should I take if I use File Browser?

First, inventory your systems to locate all active File Browser instances. Determine if any are configured with the proxy authentication method. If proxy authentication is enabled, treat this as a high priority for review, identify the application owners, and evaluate your configuration to determine if you can switch to a more secure authentication method or restrict network access to the server.

References

github.com/filebrowser/filebrowser/security/advisories/GHSA-xqp3…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.