The vulnerability arises from the hook system in File Browser, which executes administrator‑defined shell commands when file events occur. Because variable placeholders such as $FILE and $USERNAME are expanded using os.Expand without sanitization, a maliciously crafted filename containing shell metacharacters can cause the server to run arbitrary OS commands. An attacker with write permission to the target directory can exploit this on any installation that has the hook functionality enabled, leading to unrestricted remote code execution.

The flaw affects File Browser versions 2.0.0 through 2.63.1. In all releases prior to version 2.33.8 the hook feature is enabled by default, while from 2.33.8 onward it is disabled. Existing installations that have not updated or that have not disabled the hook remain vulnerable, whereas fresh deployments of v2.33.8 or newer are not susceptible unless the option is re‑enabled.

The CVSS score is 7.5, indicating high severity, and the vulnerability is not listed in the CISA KEV catalog. Although the EPSS metric is unavailable, the possibility of exploitation requires the attacker to write a file to a monitored directory, which is a common capability in many deployments. Given that the error can trigger full command execution, the risk is significant for any system that still allows the hook mechanism to run; an attacker who succeeds would gain control of the host.