File Browser: Command Injection via Authentication Hook Shell Substitution (Pre-Authentication RCE) (CVE-2026-54088) | HOL Guard CVE