CVE-2026-54088

CriticalCVSS 9.3/10Last modified Jun 25, 2026

Description

File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.

Metrics

CVSS 4.0 9.3/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78CWE-88CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Jun 25, 2026
Last modified
Jun 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-540899.1File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. StaCVE-2026-54095.5Monero protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of serviceCVE-2026-540908.7File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540917.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540926.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540936.8File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540947.5File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540968.4File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540977.2File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. PriCVE-2026-540998.8A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. The WICD CSR auto-approver validateCVE-2026-54106.4The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the spinner field in versions up to, and includingCVE-2026-541008.3A flaw was found in the Windows Machine Config Operator (WMCO) for Red Hat OpenShift Container Platform. WMCO establishes SSH connections to
CVE-2026-54088: Critical severity, CVSS 9.3 | Vulnix