https://feed.craftedsignal.io/vendors/file-browser/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 10 Jul 2026 19:35:16 +0000https://feed.craftedsignal.io/briefs/2026-07-filebrowser-preauth-rce/Fri, 10 Jul 2026 19:35:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-07-filebrowser-preauth-rce/The Hook Authentication feature in File Browser (versions up to 2.63.5) is vulnerable to a pre-authentication command injection flaw (CVE-2026-54088), allowing an unauthenticated remote attacker to execute arbitrary OS commands by injecting shell metacharacters into login fields during `os.Expand` operations, leading to critical Remote Code Execution (RCE) without valid credentials.The File Browser application, specifically versions up to and including 2.63.5, contains a critical pre-authentication remote code execution (RCE) vulnerability, identified as CVE-2026-54088. This flaw resides within its Hook Authentication feature, where the application delegates login verification to an external shell command. User-supplied credentials, particularly the username and password, are interpolated into this command string using os.Expand without proper sanitization. Consequently, an unauthenticated remote attacker can inject shell metacharacters into the login fields, such as the username or password. This manipulation causes the server to execute arbitrary operating system commands with the privileges of the File Browser process before any authentication can take place. The vulnerability allows for complete server compromise, making it a high-priority threat for organizations utilizing affected File Browser instances, especially those exposed to the internet.

Attack Chain

1. An administrator configures File Browser's Hook Authentication feature, setting up an external shell command for login verification (e.g., sh -c "test $USERNAME = 'admin'").
2. An unauthenticated attacker sends a crafted login request to the File Browser instance via HTTP (e.g., using curl or the web UI).
3. The attacker injects shell metacharacters (e.g., ; id #) into the username field of the login request.
4. The File Browser application's auth/hook.go HookAuth.RunCommand function processes the login attempt.
5. Inside RunCommand, the os.Expand function performs a plain text substitution, embedding the attacker's malicious input directly into the configured shell command string.
6. The manipulated command, now containing the injected shell commands, is executed by the server (e.g., sh -c "test ; id # = 'admin'").
7. The attacker's arbitrary command (e.g., id) is executed on the server with the privileges of the filebrowser process.
8. The attacker achieves pre-authentication remote code execution, enabling data exfiltration, persistent backdoor installation, or lateral movement.

Impact

An unauthenticated remote attacker can achieve full control over the server hosting the File Browser instance. This pre-authentication RCE means compromise requires no prior foothold, no valid credentials, and a single crafted HTTP request. Successful exploitation leads to severe consequences, including complete server compromise, data exfiltration, installation of persistent backdoors, and potential lateral movement into internal networks. Any internet-facing File Browser deployment with Hook Authentication enabled is at critical risk of full system takeover.

Recommendation

• Patch CVE-2026-54088 immediately by upgrading File Browser to a version greater than 2.63.5.
• If immediate patching is not possible, disable the Hook Authentication feature in File Browser.
• Deploy the Sigma rule "Detect CVE-2026-54088 Exploitation - File Browser Command Injection" to your SIEM and monitor for process_creation events, specifically unusual child processes spawned by the filebrowser executable.
• Enable process_creation logging for Linux systems to ensure visibility for the detection rule.

]]>criticaladvisorycommand-injectionrceweb-applicationhttps://feed.craftedsignal.io/briefs/2024-01-file-browser-auth-bypass/Mon, 08 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-file-browser-auth-bypass/File Browser versions before 2.63.1 improperly grant execution capabilities to new users created via proxy authentication, leading to privilege escalation.File Browser is a file management interface that allows users to upload, delete, preview, rename, and edit files. A vulnerability, identified as CVE-2026-35607, exists in versions prior to 2.63.1. This flaw stems from inconsistent application of a fix intended to restrict execution permissions for self-registered users. While the fix was correctly implemented for the signup handler (commit b6a4fb1), it was not applied to the proxy authentication handler. As a result, users automatically created upon their first successful proxy authentication login are inadvertently granted execution capabilities based on global defaults. This contradicts the intended security measure of preventing automatic accounts from inheriting execution rights. This vulnerability allows unauthorized users to execute commands, potentially leading to system compromise. The issue is resolved in File Browser version 2.63.1.

Attack Chain

1. A user attempts to access the File Browser interface via proxy authentication.
2. The File Browser instance, running a version prior to 2.63.1, authenticates the user through the proxy.
3. If the user does not already exist, the application automatically creates a new user account.
4. Due to the missing fix in the proxy authentication handler, the newly created user account is granted execution permissions.
5. The attacker leverages the granted execution permissions to execute arbitrary commands on the server.
6. These commands could be used to read sensitive files, modify system configurations, or install malicious software.
7. The attacker uses the file management interface to upload a malicious script.
8. The attacker executes the malicious script, achieving arbitrary code execution on the server, potentially leading to data exfiltration or system takeover.

Impact

Successful exploitation of CVE-2026-35607 allows unauthenticated or newly authenticated users to gain unauthorized execution privileges within the File Browser application. This can lead to the execution of arbitrary commands, potentially compromising the server hosting the application. The CVSS v3.1 base score for this vulnerability is 8.1, indicating a high level of severity. Depending on the server configuration, this could result in data breaches, system downtime, or complete system takeover.

Recommendation

• Upgrade File Browser to version 2.63.1 or later to remediate CVE-2026-35607.
• Implement the Sigma rule "Detect File Browser Unauthorized Command Execution" to identify potential exploitation attempts by monitoring for suspicious process creation events initiated by the File Browser process.
• Review and restrict the default execution permissions for File Browser to minimize the impact of potential exploits.
• Monitor web server logs for unusual activity associated with File Browser, specifically HTTP requests related to file uploads and execution.

]]>highadvisoryfile-browserauthentication-bypassprivilege-escalationcve-2026-35607