CVE-2026-54088 Exploit Metadata

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Python script (exploit.py) sends a crafted POST request to /api/login with a command injection payload in the username field to achieve pre-authentication RCE on File Browser <= 2.63.5.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of two README files (English and Japanese) and a Python exploit script (exploit.py). All content describes and implements a proof-of-concept for CVE-2026-54088, a pre-authentication command injection in File Browser's Hook Authentication feature. The exploit sends a crafted login request with a shell command in the username field to trigger the vulnerability. No concealed, deceptive, or unrelated harmful behavior was observed. The script's actions are limited to sending the described exploit payload and printing status messages; it does not establish persistence, exfiltrate data, or execute any hidden payload.

ClassificationExploit

Model confidence95%

AuthenticationNot required

Languagespython

Target softwareFile Browser

Attack typesOS command injectionpre-authentication RCE

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The artifact includes a Python script (exploit.py) that actively sends a crafted request to trigger the vulnerability and execute an attacker-supplied command on the target, which is the definition of an exploit.

exploit.py:1-82README.en.md:4

Requirements

Target must be running File Browser <= 2.63.5 with Hook Authentication configured with a vulnerable command (e.g., sh -c $USERNAME).README.en.md:6README.en.md:52-58

Observed behavior

Constructs a JSON payload with a username containing a shell command followed by '; echo hook.action=block'.exploit.py:39-43
Sends an unauthenticated HTTP POST request to the /api/login endpoint with the malicious payload.exploit.py:48-53
Checks the HTTP response status and prints verification instructions for the injected command's side effect.exploit.py:55-78

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url: http://localhost:8080/api/loginTarget endpoint for the exploit payload, consistent with the described CVE.exploit.py:37
Command Injection Payload: {command}; echo hook.action=blockThe injected username payload that triggers the command injection vulnerability.exploit.py:39

Review boundaries

What the analysis did not establish

Only three of six repository files were provided as text; the remaining three files (likely docker-compose.yml, Dockerfile, init script) are omitted, so the full exploit environment setup cannot be verified.
The evidence packet reports complete_artifact_coverage as false, meaning not all files in the repository were analyzed.
Three additional files in the repository (total 6 files, 3 text files omitted) were not included in the evidence packet and were not reviewed. Their content is unknown.
Binary files were flagged as metadata-only and not analyzed; however, none were identified in this packet.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

GitHub

docker-compose.yml

Created 2026-06-03Vuln labCVE-2026-54088Compose · images

1 Compose manifest · 2 services

Analysisdeepseek-v4-pro:cloud · 2026-08-03

Environment assessment

A Docker Compose environment that runs two File Browser v2.63.5 containers: an init container that configures a vulnerable hook authentication command, and a main container that exposes the vulnerable service on port 8080. The README and exploit script describe a pre-auth command injection vulnerability (CVE-2026-54088) and provide steps to reproduce it.

docker-compose.yml:1-34README.md:1-156

Lab assessment

Vulnerability lab

The README explicitly states this is a Proof of Concept for CVE-2026-54088, a pre-auth command injection in File Browser. The Compose file sets up a vulnerable version (v2.63.5) with a hook authentication command designed to be exploitable, and the exploit script demonstrates the attack.

README.md:1-5docker-compose.yml:1-34scripts/init-filebrowser.sh:1-21

Lab shapeCompose · images

Services2

Compose manifests1

Dockerfiles0

Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries

Components

Services and files described by the evidence

filebrowser-init

initializationvulnerability configuration

Runs once to initialize the File Browser database and configure hook authentication with a vulnerable command 'sh -c $USERNAME'. This sets up the target for the command injection vulnerability.

docker-compose.yml:2-10scripts/init-filebrowser.sh:1-21

filebrowser

vulnerable targetweb application

Runs the File Browser v2.63.5 service with the hook authentication enabled, listening on port 80 inside the container and mapped to host port 8080. It serves as the target for the pre-auth RCE exploit.

docker-compose.yml:12-34

exploit.py

exploit scriptproof of concept

A Python script that sends a crafted login request to the target's /api/login endpoint, injecting a shell command via the username field to achieve pre-auth command execution.

exploit.py:1-82

CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-54088

Supported by supplied evidence

The README describes the vulnerability as a pre-auth OS command injection in File Browser <=2.63.5 via hook authentication. The init script configures the vulnerable command 'sh -c $USERNAME', and the exploit script demonstrates injection through the username field. The environment uses the affected version v2.63.5.

README.md:1-5scripts/init-filebrowser.sh:14-15exploit.py:1-82docker-compose.yml:3

Exercise context

Requirements and sequence described by the evidence

Prerequisites

Docker and Docker Compose must be installed to run the environment.README.md:79-81
The target must be reachable at http://localhost:8080 after starting the containers.README.md:83-85
Python 3 is required to run the exploit script.exploit.py:1

Evidence-described exercise path

Start the vulnerable environment with 'docker compose up -d'.README.md:79-81
Run the exploit script: 'python3 exploit.py -t http://localhost:8080 -c "touch /tmp/fb_hook_auth_pwned"'.README.md:87-89
Verify command execution inside the container: 'docker exec -it cve-2026-54088-hook-auth-vuln ls -l /tmp/fb_hook_auth_pwned'.README.md:115-117
Optionally, test via GUI by entering a malicious username in the login form and verifying with 'docker exec'.README.md:91-111
Clean up with 'docker compose down -v'.README.md:119-121

Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own vulnerable target container. The exploit script sends a single HTTP request to the local container to demonstrate the vulnerability. There is no evidence of host escape, external connections, persistence, credential theft, or destructive actions beyond the intended lab exercise.

exploit.py:1-82docker-compose.yml:1-34README.md:1-156

Review boundaries

What the analysis did not establish

The packet does not include the actual File Browser binary or source code; only the configuration and exploit are provided.
The README.en.md file is referenced but not included in the evidence files, though the Japanese README.md is present and sufficient.
The .gitignore file is listed in the inventory but not included as evidence; its content is unknown but likely irrelevant.

Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

CVE-2026-54088