CVE-2026-54088: File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE)

An unauthenticated remote attacker can execute arbitrary OS commands on the server under the privilege level of the File Browser process. This is the most severe class of vulnerability in this codebase:

• No authentication required — exposed to the entire internet if the service is public-facing.
• Single request — no setup, no enumeration, no prior foothold.
• Full server compromise: data exfiltration, persistent backdoor installation, lateral movement to internal networks.

Any internet-facing File Browser instance with Hook Authentication enabled is fully compromised by a single malformed login attempt.