PT-2026-49063

CVE-2026-54090

Published

2026-06-12

Updated

2026-07-30

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions File Browser versions prior to 2.33.8

Description When a shell interpreter is configured, the command allowlist can be bypassed using shell metacharacters. The system validates only the first token of user input, while the entire raw string is passed to the shell. This allows the use of semicolons, pipes, backticks, and $() to chain and execute arbitrary commands after a permitted one.

Recommendations Update to version 2.33.8.

Exploitability

Exploit

Fix

Impacts

Researchers

Rajchowdhury240

Vendors

Affected products

Weakness enumeration

CWE-184: Incomplete List of Disallowed Inputs

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')