EUVD-2026-39510
GHSA-m93h-4hw7-5qcm
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable login, no auth or interaction once Hook Auth is enabled (PR:N/UI:N/AC:L), yielding full RCE with high C/I/A; scope unchanged as commands run within the server's own context.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
File Browser is a file managing interface for uploading, deleting, previewing, renaming, and editing files within a specified directory. Prior to 2.63.6, the Hook Authentication feature in File Browser allows administrators to delegate login verification to an external shell command. User-supplied credentials (username and password) are interpolated into this command string using os.Expand without sanitization. An unauthenticated remote attacker can inject shell metacharacters in the username or password field at the login screen, causing the server to execute arbitrary OS commands before any authentication takes place. This is a critical pre-authentication RCE. This vulnerability is fixed in 2.63.6.
AnalysisAI
Pre-authentication remote code execution in File Browser before 2.63.6 lets unauthenticated attackers run arbitrary OS commands when the optional Hook Authentication feature is enabled. Because login credentials are interpolated into an external shell command via os.Expand without sanitization, shell metacharacters placed in the username or password field at the login screen execute on the server before authentication occurs. No public exploit identified at time of analysis, but the GitHub Security Advisory (GHSA-m93h-4hw7-5qcm) confirms the flaw and CVSS 4.0 rates it 9.3 (Critical).
Technical ContextAI
File Browser is a self-hosted Go web application providing a browser-based interface for uploading, deleting, previewing, renaming, and editing files in a designated directory (cpe:2.3:a:filebrowser:filebrowser). The flaw is a CWE-78 OS Command Injection rooted in the Hook Authentication mechanism, a feature that delegates login verification to an external shell command. The code uses Go's os.Expand to interpolate the user-supplied username and password into the command string; os.Expand performs variable substitution but provides no shell-quoting or sanitization, so attacker-controlled input is passed directly to the underlying shell, allowing metacharacters such as ;, |, $(), and backticks to break out and invoke additional commands.
RemediationAI
Upgrade to File Browser 2.63.6, which contains the vendor fix (Vendor-released patch: 2.63.6); see the advisory at https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm. If immediate upgrade is not possible, disable the Hook Authentication feature and revert to File Browser's built-in or proxy authentication, which fully removes the vulnerable os.Expand command-interpolation path at the cost of losing external login delegation. As an additional compensating control, restrict network access to the login interface (for example, place it behind a VPN or firewall-allowlist so only trusted hosts can reach the login endpoint); this reduces exposure but does not remove the underlying injection for permitted clients. Do not invent intermediate version numbers - 2.63.6 is the confirmed fixed release.
More in Filebrowser
View allUnauthorized file operations in File Browser before fix. PoC and patch available.
A cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated attacker to escalate pr
Recursive operation authorization bypass in File Browser before v2.63.22 permits any authenticated user to copy, rename,
Path normalization bypass in Filebrowser prior to 2.57.1 allows authenticated users to circumvent file access restrictio
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
File Browser versions 2.50.0 through 2.63.21 permit indefinite session persistence via expired JWT tokens when proxy aut
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Arbitrary file deletion in filebrowser before 2.63.19 allows authenticated users holding only Create permission to delet
File Browser versions prior to 2.61.0 incorrectly set the filesystem root to a parent directory when generating public s
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, previ
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today