CVE-2026-25890

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25890", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-06T21:08:39.130Z", "datePublished": "2026-02-09T21:21:50.764Z", "dateUpdated": "2026-02-10T15:57:52.236Z"}, "containers": {"cna": {"title": "File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL", "problemTypes": [{"descriptions": [{"cweId": "CWE-706", "lang": "en", "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968"}, {"name": "https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9", "tags": ["x_refsource_MISC"], "url": "https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9"}, {"name": "https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1"}], "affected": [{"vendor": "filebrowser", "product": "filebrowser", "versions": [{"version": "< 2.57.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T21:21:50.764Z"}, "descriptions": [{"lang": "en", "value": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's \"Disallow\" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1."}], "source": {"advisory": "GHSA-4mh3-h929-w968", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:32:03.411722Z", "id": "CVE-2026-25890", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:57:52.236Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25890", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-10T15:32:03.411722Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:32:04.191Z"}}], "cna": {"title": "File Browser has a Path-Based Access Control Bypass via Multiple Leading Slashes in URL", "source": {"advisory": "GHSA-4mh3-h929-w968", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "filebrowser", "product": "filebrowser", "versions": [{"status": "affected", "version": "< 2.57.2"}]}], "references": [{"url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968", "name": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9", "name": "https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1", "name": "https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's \"Disallow\" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-706", "description": "CWE-706: Use of Incorrectly-Resolved Name or Reference"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T21:21:50.764Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25890", "state": "PUBLISHED", "dateUpdated": "2026-02-10T15:57:52.236Z", "dateReserved": "2026-02-06T21:08:39.130Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T21:21:50.764Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "filebrowser", "vendor": "filebrowser", "versions": [{"status": "affected", "version": "< 2.57.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:filebrowser:filebrowser:*:*:*:*:*:*:*:*", "matchCriteriaId": "814A9A1C-C2FE-406B-AD51-62B4A826C6AF", "versionEndExcluding": "2.57.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, an authenticated user can bypass the application's \"Disallow\" file path rules by modifying the request URL. By adding multiple slashes (e.g., //private/) to the path, the authorization check fails to match the rule, while the underlying filesystem resolves the path correctly, granting unauthorized access to restricted files. This vulnerability is fixed in 2.57.1."}, {"lang": "es", "value": "Navegador de Archivos proporciona una interfaz de gesti\u00f3n de archivos dentro de un directorio especificado y se puede utilizar para subir, eliminar, previsualizar, renombrar y editar archivos. Antes de la versi\u00f3n 2.57.1, un usuario autenticado puede eludir las reglas de ruta de archivo 'Disallow' de la aplicaci\u00f3n modificando la URL de la solicitud. Al a\u00f1adir m\u00faltiples barras (por ejemplo, //private/) a la ruta, la comprobaci\u00f3n de autorizaci\u00f3n no logra coincidir con la regla, mientras que el sistema de archivos subyacente resuelve la ruta correctamente, otorgando acceso no autorizado a archivos restringidos. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 2.57.1."}], "id": "CVE-2026-25890", "lastModified": "2026-06-17T10:25:23.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25890", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:32:03.411722Z", "version": "2.0.3"}}]}, "published": "2026-02-09T22:16:03.873", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/filebrowser/filebrowser/commit/489af403a19057f6b6b4b1dc0e48cbb26a202ef9"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/filebrowser/filebrowser/security/advisories/GHSA-4mh3-h929-w968"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-706"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-863"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.57.2)"}}], "product": "filebrowser", "vendor": "filebrowser"}], "analysis": {"en": {"generated_at": "2026-04-17T21:08:22.926463+00:00", "value": {"mitigation_remediation": ["Upgrade File Browser to version 2.57.1 or newer.", "Limit user roles to the least privilege necessary for their duties, ensuring that only authorized personnel can access restricted directories.", "Configure the reverse proxy or web server to normalize URLs by collapsing or rejecting multiple leading slashes before the request reaches File Browser, effectively blocking the bypass path."], "summary": {"action": "Immediate patch", "impact": "Unauthorized file access"}, "threat_synthesis": {"affected_systems": "File Browser versions released prior to 2.57.1 are affected. The issue is present in every OS or infrastructure deployment that uses the default configuration, as the path normalization logic is independent of the host environment. Updating to any release equal to or greater than 2.57.1 removes the vulnerability, as the upstream project corrected the evaluation of path prefixes.", "description_and_impact": "The vulnerability arises from the way File Browser normalizes request URLs. When an authenticated user includes multiple leading slashes in the path, the application fails to match the configured 'Disallow' rules while the underlying filesystem still resolves the path. This mismatch allows the user to read or modify files located outside the intended directory, thereby violating the principle of least privilege and potentially exposing sensitive data. The flaw is a path\u2011based access control bypass, corresponding to CWE\u2011706 and CWE\u2011863.", "risk_and_exploitability": "The CVSS score of 8.1 indicates high severity, and the EPSS score of less than 1\u202f% suggests a low but non\u2011zero probability of exploitation in the wild. The vulnerability requires authentication, so an attacker must first obtain valid credentials or access to an authorized session; no elevated privileges are necessary to succeed. The attack vector is a web request to the File Browser API or front\u2011end, where a double slash can be injected into the requested path. Because the flaw is not automatically exploited and is limited to authenticated users, the threat remains controlled but still significant for environments where users may have access to secure directories."}}}}, "created": "2026-02-10T11:35:02.621924+00:00", "updated": "2026-04-17T21:15:27.382163+00:00", "vendors": ["filebrowser", "filebrowser$PRODUCT$filebrowser"]}