CVE-2026-54088: Pre-Authentication Remote Code Execution in File Browser Hook Authentication

File Browser is an open-source, web-based file manager that enables administrators to manage remote filesystems through a web interface. The application supports user authentication, file access controls, and administrative commands. It exposes an attack surface that includes various authentication strategies, one of which is Hook Authentication.

This Hook Authentication component allows delegation of user credential verification to custom external scripts or executables. During a login attempt, File Browser triggers a subprocess running the configured command to check the credentials. This capability is useful for integrating external directory services or bespoke access databases.

The vulnerability designated as CVE-2026-54088 lies in the implementation of this Hook Authentication workflow. When handling a login request, the application processes user-provided credentials without performing input verification or sanitization. This allows an unauthenticated external attacker to achieve arbitrary command execution on the host operating system.

The vulnerability resides in the Go backend implementation of File Browser, specifically in the file auth/hook.go within the HookAuth.RunCommand function. When Hook Authentication is enabled, administrators configure a template command string. This template uses environment-style placeholders, such as $USERNAME and $PASSWORD, which are later substituted with actual login credentials.

To perform this substitution, the code splits the configured command string by whitespace into an execution slice. It then loops over the command arguments and performs literal variable expansion using Go's standard library os.Expand function. The expansion relies on a custom mapping function that returns the unauthenticated user-supplied credentials directly from the incoming HTTP POST request.

Because os.Expand performs textual replacement without sanitizing shell-specific characters, input fields containing shell metacharacters are written directly into the arguments of the execution slice. If the target command runs within a shell interpreter, the shell parses and executes these injected metacharacters. Consequently, characters such as semicolons, pipes, or command substitutions trigger secondary OS command execution during the pre-authentication phase.

To understand the vulnerable design pattern, compare the legacy implementation in auth/hook.go with the corrected logic introduced in version 2.63.6.

// Vulnerable Implementation (auth/hook.go <= v2.63.5)
func (a *HookAuth) RunCommand() (string, error) {
	command := strings.Split(a.Command, " ")
	envMapping := func(key string) string {
		switch key {
		case "USERNAME":
			return a.Cred.Username // Unsanitized credential payload
		case "PASSWORD":
			return a.Cred.Password // Unsanitized credential payload
		default:
			return os.Getenv(key)
		}
	}
	for i, arg := range command {
		if i == 0 {
			continue
		}
		command[i] = os.Expand(arg, envMapping) // Command injection happens here
	}
 
	cmd := exec.Command(command[0], command[1:]...)
	cmd.Env = append(os.Environ(), fmt.Sprintf("USERNAME=%s", a.Cred.Username))
	cmd.Env = append(cmd.Env, fmt.Sprintf("PASSWORD=%s", a.Cred.Password))
    // ...
}

// Fixed Implementation (auth/hook.go >= v2.63.6)
func (a *HookAuth) RunCommand() (string, error) {
	command := strings.Split(a.Command, " ")
 
	cmd := exec.Command(command[0], command[1:]...)
	cmd.Env = append(os.Environ(), fmt.Sprintf("USERNAME=%s", a.Cred.Username))
	cmd.Env = append(cmd.Env, fmt.Sprintf("PASSWORD=%s", a.Cred.Password))
    // ...
}

In the patched version, the entire argument interpolation block using os.Expand has been removed. The static arguments of the command slice are passed without modifications. Instead of injecting credentials as part of the command arguments, the backend relies strictly on environment variables (cmd.Env) to pass the username and password details.

This architecture is safe because the Go standard library exec.Command implements low-level operating system process execution (using execve on POSIX systems or CreateProcess on Windows). System calls do not invoke a command-line shell by default unless an interpreter is explicitly specified as the target binary. Passing raw credential data through environment variables ensures that the data is never evaluated as command code, eliminating the parsing step that enabled the injection vector.

An unauthenticated attacker can exploit CVE-2026-54088 by sending a specially crafted HTTP POST request to the /api/login endpoint of a vulnerable File Browser instance. The attack requires no pre-existing valid credentials or active session. The attacker must only ensure that the Hook Authentication feature is configured and active on the target server.

The payload is placed directly within the JSON request body, using either the username or password keys. An attacker injects command separators or backticks containing OS-level commands into these fields. During processing, the backend invokes the Hook script and substitutes the malicious payload string. The shell interprets the metacharacters, executing the injected payloads immediately.

A public proof of concept (PoC) repository (Saku0512/CVE-2026-54088-poc) demonstrates this execution path. It sends a request containing a semicolon separator followed by system utility calls. The following flow diagram illustrates the step-by-step path from remote request to local execution:

The impact of CVE-2026-54088 is rated with critical severity, carrying a CVSS 4.0 base score of 9.3. Successful exploitation yields immediate, unauthenticated remote command execution under the security context of the user running the File Browser service. The attacker achieves full execution capability before any access validation takes place.

The compromised system allows attackers to read and alter all files managed by File Browser. Additionally, they can read configuration files, extract system credentials, and install rootkits or persistent backdoors. Depending on network topology, this system can also serve as a launchpad to pivot into local or private subnets.

While dockerized installations of File Browser restrict initial access to the container filesystem, container escape risks remain if the service runs with elevated privileges. In bare-metal installations, the compromise is direct and can lead to complete host takeover. The threat potential is high for internet-exposed file management services that hold business-critical storage volumes.

Administrators should update File Browser instances to version 2.63.6 or later immediately. This patch removes the vulnerable os.Expand routine and safely encapsulates credential passing through the process environment block. Upgrading resolves the underlying parsing vulnerability without requiring modifications to external verification scripts.

If upgrading is not immediately possible, the Hook Authentication feature should be disabled. Reverting to database-backed authentication removes the vulnerability, as the default database backend does not spawn external shell processes. Transitioning to another external authentication mechanism like LDAP is also a viable mitigation path.

As a temporary layer of defense, organizations can deploy WAF signatures to detect malicious patterns targeting the /api/login endpoint. Specifically, WAF rules should filter incoming requests containing typical command injection characters in the username and password payload fields. These rules act as a stopgap and must not substitute for the vendor-issued patch.