The Hook Authentication feature in File Browser (file auth/hook.go, function HookAuth.RunCommand) allows administrators to delegate login verification to an external shell command. This command string is constructed by substituting the username and password using Go's os.Expand function without any escaping or validation. An attacker can inject shell metacharacters in the username or password fields at the login screen, causing the server to execute arbitrary OS commands before any authentication occurs. This results in a critical pre-authentication remote code execution vulnerability (CWE-78, CWE-88, CWE-306). The vulnerability affects all versions prior to 2.63.6. The CVSS v4.0 base score is 9.3 (Critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on system confidentiality, integrity, and availability.

An unauthenticated remote attacker can execute arbitrary operating system commands on the server hosting File Browser with the privileges of the File Browser process. This allows full compromise of the server, including reading sensitive data, modifying or deleting files, and disrupting service availability. Because the vulnerability is exploitable without authentication and requires only a single request, it poses a severe risk to any public-facing File Browser instance using the Hook Authentication feature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should disable the Hook Authentication feature or avoid using external shell commands for authentication. Avoid exposing the File Browser login interface to untrusted networks. Monitor vendor communications for an official patch or update that addresses this command injection vulnerability.