Go/github.com/filebrowser/filebrowser/v2 CVE-2026-54088: critical, EPSS 0.76%

File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

Action: Upgrade github.com/filebrowser/filebrowser/v2 to 2.63.6 or later.

go get github.com/filebrowser/filebrowser/v2@v2.63.6

Affected

Fixed versions

Sources

• osv: GHSA-m93h-4hw7-5qcm
• https://github.com/filebrowser/filebrowser/security/advisories/GHSA-m93h-4hw7-5qcm
• https://nvd.nist.gov/vuln/detail/CVE-2026-54088
• https://github.com/filebrowser/filebrowser

CVE-2026-54088 · published 2026-07-10T19:32:32Z · modified 2026-07-21T19:19:08.492652967Z · JSON