CVE-2026-25889
File Browser has an Authentication Bypass in User Password Update
- Published
- Updated
- Reserved
- Assigned by
- GitHub_M
Description
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to 2.57.1, a case-sensitivity flaw in the password validation logic allows any authenticated user to change their password (or an admin to change any user's password) without providing the current password. By using Title Case field name "Password" instead of lowercase "password" in the API request, the current_password verification is completely bypassed. This enables account takeover if an attacker obtains a valid JWT token through XSS, session hijacking, or other means. This vulnerability is fixed in 2.57.1.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_MCNA (assigner) | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Analyzed | 3.1 | Medium5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.36% · top 70% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.
Weakness
Affected products
- affected < 2.57.1
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogithub.com/filebrowser/filebrowser/v2GHSA-hxw8-4h9j-hq2r (opens in a new tab)
References (3)
- https://github.com/filebrowser/filebrowser/security/advisories/GHSA-hxw8-4h9j-hq2r (opens in a new tab)x_refsource_CONFIRM
- https://github.com/filebrowser/filebrowser/commit/ff2f00498cff151e2fb1f5f0b16963bf33c3d6d4 (opens in a new tab)x_refsource_MISC
- https://github.com/filebrowser/filebrowser/releases/tag/v2.57.1 (opens in a new tab)x_refsource_MISC
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-hxw8-4h9j-hq2r (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-25889)Record last updated .