The vulnerability arises from the Hook Authentication feature, which delegates login verification to an arbitrary shell command. The command string is built by expanding user‑supplied credentials without any sanitization, allowing an unauthenticated attacker to inject shell metacharacters into the username or password fields. The injected characters cause the server to execute arbitrary OS commands before authentication completes, resulting in remote code execution with the privileges of the web server process. This flaw is an instance of OS Command Injection and effectively bypasses all authentication controls.

The product affected is File Browser by filebrowser. All releases prior to version 2.63.6 are vulnerable because they implement the insecure Hook Authentication logic. Versions 2.63.6 and later have the issue fixed.

The CVSS score of 9.3 classifies the flaw as critical. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of a patch does not reduce the potential for exploitation. An attacker can gain remote code execution by accessing the public login endpoint of a File Browser instance with Hook Authentication enabled, crafting a payload that contains shell metacharacters in the username or password field. No special credentials or network restrictions are required, making this an easily exploitable pre‑authentication vulnerability.